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CHAPTER  1 


INTRODUCTION 


Hasan’s  ideology  conflicted  with  standard  military  obligations,  and  his 
repeated  statements  that  he  could  not  support  combat  against  enemies  of  this 
country  because  they  shared  his  religious  beliefs  demonstrated  that  he  did  not 
belong  in  the  United  States  military. 

—  GEN  Jack  Keane,  USA,  Retired 
A  Ticking  Time  Bomb 

In  October  1995,  US  Army  Sergeant  (SGT)  William  Kreutzer,  a  member  of  the 
82nd  Airborne  Division  stationed  at  Fort  Bragg,  North  Carolina,  opened  fire  on  a 
morning  physical  training  formation  of  1300  Soldiers  with  two  semi-automatic  rifles. 
Unarmed  members  of  that  formation  were  able  to  subdue  the  shooter,  but  not  before  he 
left  one  dead  and  an  additional  seventeen  other  Soldiers  wounded.  In  November  2009, 

US  Army  Major  Nidal  Malik  Hasan,  a  psychiatrist  assigned  to  Fort  Hood,  Texas,  entered 
the  Fort  Hood  Soldier  Readiness  Center  and  opened  fire  with  a  FN  Herstal  Five-Seven 
pistol,  killing  thirteen  and  wounding  an  additional  thirty-two  before  law  enforcement 
could  stop  him.  In  both  of  these  cases,  the  perpetrators  displayed  several  threat  indicators 
that  if  acted  upon  could  have  allowed  authorities  to  prevent  these  attacks.  After  action 
reports  and  investigations  following  each  of  these  events  all  show  that  people  who  knew 
the  attackers  were  well  aware  of  extremist  or  violent  tendencies,  but  either  dismissed  the 
indicators  or  failed  to  report. 


Purpose 

Although  relatively  rare,  insider  threat  events  still  occur  in  US  Army  formations. 
Based  upon  these  actions  many  actions  could  and  should  take  place.  These  threats  take 
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away  from  readiness  and  require  commanders  and  units  to  ensure  all  mitigation  measures 
take  place  to  prevent  or  reduce  the  effects  of  these  insider  threat  direct  action  attacks. 

This  thesis  will  use  the  findings  from  case  studies  of  past  direct  action  attacks  to  propose 
training  recommendations  that  would  compel  soldiers  who  witness  indicators  to  report. 

Proposed  Research  Question 

In  order  to  help  law  enforcement,  commanders,  and  the  intelligence  community  to 
prevent  insider  threats  from  developing  into  direct  action  attacks,  this  study  sought  to 
answer  the  question:  How  does  the  Army  compel  Soldiers  to  report  suspicious  activity 
associated  with  insider  threats?  In  addition,  secondary  research  questions  include:  What 
are  the  Threat  Awareness  and  Reporting  Program's  (TARP)  goals,  and  what  should  it 
provide?  Does  the  Army’s  mandatory  TARP  training  effectively  prevent  direct  action 
attacks  by  insider  threats?  What  actions  are  available  to  commanders  who  identify 
potential  insider  threats  within  their  organizations? 

Importance 

Although  the  numbers  of  casualties  inflicted  by  insider  threats  are  relatively  small 
when  compared  to  combat  casualties  or  other  threats  to  service  members,  such  as 
vehicular  accidents,  direct  action  attacks  against  unarmed  Soldiers  carried  out  by  their 
comrades  have  a  significant  impact  on  the  sense  of  security  of  personnel  on  a  military 
installation.  Preventing  an  insider  threat  attack  is  a  daunting  task  to  law  enforcement, 
commanders,  and  the  intelligence  community,  as  it  is  extremely  difficult  in  most 
circumstances  to  identify  would-be  attackers  without  the  help  of  fellow  Soldiers  reporting 
suspicious  activity.  Even  then,  would-be  attackers  often  do  not  break  any  laws  prior  to 
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actually  conducting  the  attack,  so  what  is  the  proper  response  when  the  military  chain  of 
command  and  law  enforcement  actually  do  receive  indications  of  a  threat  within  their 
formations? 


Assumptions 

First,  insider  threat  direct  action  attacks  are  typically  a  result  of  a  lone  perpetrator 
who  for  one  reason  or  another  feels  ostracized  by  the  chain  of  command  and/or  their 
peers  for  their  personal  beliefs.  Historically,  there  are  several  events  over  time  that  drive 
the  attacker  to  gradually  come  to  the  point  where  they  are  willing  to  carry  out  an  attack. 
Next,  this  study  assumed  that  Soldiers  and  commanders  are  reluctant  to  act  on  suspicions 
when  they  notice  violent  tendencies  because  they  are  either  afraid  of  offending  certain 
beliefs  or  because  they  do  not  take  the  threats  seriously.  The  Army  trains  extensively  on 
religious  freedoms,  Equal  Opportunity  (EO),  and  rights  of  Soldiers  to  express  their 
beliefs,  but  does  not  adequately  train  Soldiers  to  recognize  when  these  freedoms  of 
speech  overstep  their  bounds  and  are  actually  threats  to  the  good  order  and  discipline,  or 
even  physical  safety,  of  a  unit. 

The  last  assumption  builds  on  the  previous  assumption  that  soldiers  are  not 
properly  trained  to  recognize  and  report  insider  threats.  This  assumption  is  that  more 
training  can  successfully  to  reduce  attacks.  This  training  should  focus  on  two  areas.  First, 
soldiers  and  commanders  need  training  to  recognize  when  potential  insider  threats  are 
marginalized  within  their  organizations,  and  how  they  can  bring  these  soldiers  back  into 
the  fold.  If  soldiers  are  accepted  for  who  they  are  and  brought  into  the  cohesiveness  of  a 
team,  they  will  be  less  likely  to  feel  the  need  to  commit  an  act  of  violence  against  their 
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peers.  Second,  training  can  help  compel  soldiers  to  report  suspicious  behavior  to  their 
command  or  proper  authorities. 

Operational  Definition  of  Key  Terms 
Insider  Threat  Defined 

The  insider  threats  referenced  in  this  study  are  narrowly  focused  on  persons  who 
are  US  service  members  or  DOD  employees  who  plan  or  carry  out  direct  action  attacks 
on  fellow  Soldiers  and  DOD  employees  with  the  intent  to  inflict  loss  of  life  through 
violent  means.  This  definition  does  not  match  up  exactly  with  the  official  Army 
definition  of  insider  threat,  which  is  broader  in  its  description. 

The  official  Army  definition  of  an  insider  threat  comes  from  Army  Regulation 
381-12,  Threat  Awareness  and  Reporting  Program.  According  to  TARP,  an  insider  threat 
is  a  person  with  placement  and  access  who  intentionally  causes  loss  or  degradation  of 
resources  or  capabilities  or  compromises  the  ability  of  an  organization  to  accomplish  its 
mission  through  espionage,  providing  support  to  international  terrorism,  or  the 
unauthorized  release  or  disclosure  of  information  about  the  plans  and  intentions  of  US 
military  forces.  There  are  two  main  issues  with  the  Army’s  official  definition.  First,  it 
primarily  focuses  on  espionage  and  the  unauthorized  release  of  information.  Second,  the 
part  that  addresses  terrorist  type  direct  action  attacks  specifically  ties  the  act  to 
international  terrorism.  While  this  may  be  true  in  some  cases,  not  all  direct  action  attacks 
have  clearly  defined  ties  to  international  terrorist  organizations  (ITOs).  These  types  of 
activities  fall  into  the  next  two  key  terms. 
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Extremist  Activity  Defined 


According  to  AR  381-12,  extremist  activity  is  defined  as  an  activity  that  involves 
the  use  of  unlawful  violence  or  the  threat  of  unlawful  violence  directed  against  the  Army, 
DOD,  or  the  United  States  based  on  political,  ideological,  or  religious  tenets,  principles, 
or  beliefs.  While  this  definition  fits  with  the  Nidal  Hasan  case  study,  it  still  does  not 
address  the  William  Kreutzer  shooting  that  took  place  in  1995. 

Threat  Defined 

TARP’s  definition  of  a  threat  is  a  little  broader  than  its  definitions  of  insider  threat 
and  extremist  activity.  According  to  AR  381-12,  a  threat  is  described  as  the  activities  of 
foreign  intelligence  services,  foreign  adversaries,  ITOs,  or  extremists  that  may  pose  a 
danger  to  the  Army,  DOD,  or  the  United  States;  any  person  with  access  to  Soldiers,  DOD 
installations,  and  facilities  who  may  be  positioned  to  compromise  the  ability  of  a  unit  to 
accomplish  its  mission  where  there  is  evidence  to  indicate  that  he  may  be  acting  on 
behalf  of  or  in  support  of  foreign  intelligence,  foreign  adversaries,  international  terrorists, 
or  extremist  causes  (insider  threat). 


Terrorism  Defined 

According  to  AR  381-12,  terrorism  is  defined  as  the  calculated  use  of  violence  or 
threat  of  violence  to  inculcate  fear,  intended  to  coerce  or  to  intimidate  governments  or 
societies  in  the  pursuit  of  goals  that  are  generally  political,  religious,  or  ideological. 
Terrorism  according  to  this  definition  differs  from  workplace  violence.  In  the  case  of  the 
Fort  Hood  shootings  of  2009,  the  ties  to  Islamic  extremism  and  a  known  international 
terrorist  classify  that  attack  as  a  terrorist  attack.  In  the  Fort  Bragg  shootings  of  1995, 
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there  were  no  known  political,  religious,  or  ideological  ties,  which  would  not  classify  that 
attack  as  an  act  of  terrorism.  However,  since  the  perpetrator  was  a  soldier  who  attacked 
other  soldiers,  both  cases  do  classify  as  insider  threats. 

Targeted  Violence  Defined 

For  the  purpose  of  this  study,  this  thesis  will  use  the  definition  used  in  the  2014 
DOD  Defense  Science  Board  Task  Force  Report:  Predicting  Violent  Behavior.  According 
to  the  report,  targeted  violence  is  pre-meditated  attacks  against  specific  individuals, 
populations,  or  facilities  with  perpetrators  engaged  in  behaviors  that  precede  and  are 
related  to  their  attacks.  Perpetrators  of  targeted  violence  consider,  plan,  and  prepare 
before  engaging  in  acts  of  violence.  Planning  and  preparation  steps  are  often  detectable, 
providing  an  opportunity  for  disruption  of  intended  violence.  These  perpetrators  feel  that 
they  are  not  valued/validated  and  are  singled  out.  They  subsequently  feel  that 
organizations  or  specific  people  are  out  to  get  them.  There  is  a  shift  from  self-defense  to 
self-preservation  and  thus  a  need  to  destroy  the  individuals,  populations,  or  the 
organizational  representatives  that  they  feel  wants  to  destroy  them.  Violence  is  then 
viewed  as  an  option  and  the  progression  from  ideation  to  attack  begins.  Targeted  violence 
motivators  are  not  limited  to  a  single  cause  (e.g.  a  particular  religious,  financial,  racial,  or 
social  outlook). 


Scope 

The  information  obtained  in  the  conduct  of  research  for  this  thesis  derived  from 
current  Army  doctrine,  congressional  reports,  court  cases,  and  case  studies.  In  order  to 
assess  the  scope  of  the  problem  and  identify  answers  to  the  research  questions,  this  study 
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conducted  a  literature  review  of  the  available  research.  This  thesis  seeks  to  achieve  three 


goals:  (1)  Identify  current  Army  policies  and  regulations  regarding  TARP  education  of 
the  force,  (2)  Identify  all  available  options  to  commanders  and  supervisors  who  have 
high-risk  Soldiers  within  their  formations,  and  (3)  Make  recommendations  toward 
improving  how  the  Army  compels  Soldiers  to  report  suspicious  behaviors  and  activities 
to  the  proper  authorities. 


Limitations 

The  primary  limitation  is  the  time  available  to  conduct  research.  There  are 
multiple  sources  of  research  material  available  on  the  subject,  much  of  which  will  be 
discussed  in  the  next  chapter  of  this  study.  These  sources  of  information  range  from 
current  and  past  Army  doctrine,  after  action  reports,  congressional  hearings,  military 
journal  articles,  and  case  studies.  Given  more  time,  it  would  be  possible  to  delve  deeper 
into  the  topic  and  potentially  develop  additional  research  findings. 

In  addition,  use  of  secondary  source  material  due  to  lack  of  access  to  law 
enforcement  original  reports  limits  the  amount  of  first-hand  knowledge  available  for 
research.  Specifically  for  the  case  studies,  the  majority  of  information  is  derived  from  US 
Senate  hearings  or  other  case  studies  written  by  second-hand  sources.  Actual  interviews 
of  witnesses  or  others  involved  in  the  cases  were  not  available  to  the  researcher. 

Delimitations 

Although  there  are  many  cases  where  insider  threats  conducted  targeted  violence 
within  the  United  States,  this  study  focused  solely  on  cases  where  a  US  Army  Soldier 
attacked  fellow  Soldiers.  For  the  purposes  of  this  study,  plots  against  US  service 
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members  carried  out  by  civilians  or  civilian  on  civilian  attacks  were  not  considered.  The 
reason  for  this  is  to  focus  specifically  on  what  steps  the  Army  needs  to  take  in  order  to 
counter  insider  threats  within  its  own  organization.  However,  narrowing  the  scope  of  the 
case  studies  does  not  go  without  implications. 

The  use  of  only  two  case  studies  may  provide  a  challenge  to  the  findings  of  the 
research.  First,  there  is  only  a  limited  amount  of  information  available  to  the  specific 
cases  of  insider  threat  the  author  chose  to  research.  Second,  as  stated  before,  the 
information  available  concerning  these  two  case  studies  is  limited  to  second  or  third-hand 
knowledge  of  the  incidents.  Without  reading  first-hand  reports,  some  of  the  details  of  the 
cases  could  potentially  be  missed  by  the  author.  Currently,  TARP  training  is  only 
conducted  annually.  With  proper  reinforcement  and  multiple  training  events  per  year, 
Soldiers  could  be  less  likely  to  keep  reporting  as  an  afterthought. 

Significance  of  Study 

Direct  action  attacks  carried  out  by  insider  threats  have  a  psychological  impact  on 
units  across  the  force.  Although  they  are  relatively  rare,  the  ramifications  to  Army 
doctrine  and  training  are  significant.  This  study  intends  to  highlight  some  of  the 
vulnerabilities  in  current  Army  insider  threat  doctrine  and  identify  the  reasons  service 
members  are  hesitant  to  report  suspicious  activity  to  their  commanders,  law  enforcement, 
and  intelligence  services.  Upon  examination  of  the  research  findings,  this  study  will 
propose  some  solutions  to  increase  reporting,  thereby  reducing  the  number  of  attacks. 
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Chapter  Summary 


This  thesis  examines  the  primary  research  question:  How  does  the  Army  compel 
Soldiers  to  report  suspicious  activity  associated  with  insider  threats?  Secondary  research 
questions  are  as  follows: 

1.  What  are  the  Threat  Awareness  and  Reporting  Program's  (TARP)  goals,  and 
what  should  it  provide? 

2.  Does  the  Army’s  mandatory  TARP  training  effectively  prevent  direct  action 
attacks  by  insider  threats? 

3.  What  actions  are  available  to  commanders  who  identify  potential  insider 
threats  within  their  organizations? 

As  an  initial  research  hypothesis  the  author  proposes  that:  current  TARP  training  is  not 
sufficient  to  properly  educate  Soldiers  to  report  indicators  of  insider  threats  and 
commanders  do  not  understand  the  options  that  are  available  to  them  when  they  have 
high-risk  Soldiers  within  their  formations. 

Chapter  2  will  review  the  literature  on  this  topic  and  provide  an  assessment  of  its 
significance  to  this  thesis.  It  will  be  followed  by  an  explanation  of  the  methodology,  and 
the  subsequent  chapters  will  examine  Army  doctrine  and  two  case  studies,  in  detail.  The 
conclusion  of  this  project  will  provide  recommendations  on  improved  implementation  of 
TARP. 
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CHAPTER  2 


LITERATURE  REVIEW 

Chapter  Introduction 

This  chapter  focuses  on  the  available  literature  on  insider  threats,  as  well  as  the 
Army’s  doctrine  on  countering  insider  threat.  The  primary  research  question  this  study 
intends  to  answer  is:  How  does  the  Army  compel  Soldiers  to  report  suspicious  activity? 

In  addition,  secondary  research  questions  include:  Does  the  Army’s  mandatory  Threat 
Awareness  and  Reporting  Program  (TARP)  training  effectively  prevent  direct  action  by 
insider  threats?  What  are  TARP's  goals,  and  what  should  it  provide? 

This  literature  is  structured  in  accordance  with  the  three  primary  sections  of  the 
study.  First,  this  thesis  examines  two  case  studies  where  US  Army  Soldiers  conducted 
targeted  violence  against  their  fellow  Soldiers.  This  section  looks  at  the  attackers’ 
motivations,  indicators  they  presented  prior  to  the  attacks,  and  reasons  these  attacks  were 
not  prevented.  Second,  the  literature  review  looks  into  the  Army’s  insider  threat 
education  and  reporting  program,  or  TARP,  as  well  as  any  other  formalized  education  for 
cultural  understanding.  Third,  the  study  delved  into  Army  policies  and  regulations 
regarding  options  currently  available  to  commanders  with  identified  high  risk  Soldiers  in 
their  formations.  This  includes  limitations  on  information  sharing  and  general 
understanding  of  the  Privacy  Act  of  1974,  the  Health  Insurance  Portability  and 
Accountability  Act  of  1996  (HIPAA),  and  organizational  constructs  that  limit 
information  sharing  among  different  commands  and  agencies.  It  also  includes  research 
into  command  policy  to  identify  all  available  options  to  commanders  such  as  disciplinary 

actions,  administrative  options,  and  external  support  from  outside  organizations. 
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In  order  to  focus  the  study  specifically  on  insider  threats  pertaining  to  targeted 
violence,  this  literature  review  does  not  include  information  pertaining  to  cases  involving 
espionage  or  the  release  of  information  about  plans  and  intentions  of  US  military  forces. 
Although  TARP  covers  a  broad  range  of  insider  threats,  this  thesis  deals  with  the  sections 
that  involve  terrorist  actions  and  targeted  violence.  The  literature  reviewed  is  not  limited 
in  scope  to  insider  threats  with  ties  to  a  foreign  nexus,  nor  is  it  limited  to  insider  threats 
that  could  be  classified  as  terrorists.  This  study  looked  at  all  insider  threats  to  US  Army 
personnel,  regardless  of  the  attacker’s  motivations  for  conducting  the  attacks. 

Case  Studies 

For  the  two  insider  threat  cases  considered  in  this  study,  the  majority  of  available 
literature  consists  of  US  Government  investigative  after  action  reports  and  court  hearing 
transcripts.  These  reports  provided  background  information  on  the  perpetrators  and 
attacks,  indicators  the  perpetrators  displayed  prior  to  the  attacks,  and  shortfalls  in 
intelligence  and  law  enforcement  agencies  in  identifying  the  threats  prior  to  the  attacks. 
These  reports  identify  that  in  both  cases  key  indicators  were  either  seen  and  not  reported, 
reported  and  not  developed  by  law  enforcement,  or  known  to  commanders  or  law 
enforcement  yet  not  acted  upon. 

In  regards  to  missing  information  in  the  case  studies  the  author  sought  to  identify, 

there  are  two  main  areas  of  focus.  First,  the  researcher  did  not  have  access  to  original  law 

enforcement  and  intelligence  reports.  Therefore,  all  information  obtained  during  the 

conduct  of  research  was  through  second  or  third-party  information.  Access  to  first-hand 

information  could  possibly  provide  further  context  into  the  attacks  and  provide 

information  regarding  the  command  relationships  and  other  factors  involving  the 
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attackers.  Second,  although  the  available  information  pertaining  to  the  two  case  studies 


provided  significant  information  concerning  the  attacks  and  the  events  leading  up  to  the 
attack,  neither  case  study  addresses  the  author’s  primary  question,  how  to  best  compel 
Soldiers  to  report.  This  research  adds  to  the  body  of  knowledge  by  adding 
recommendations  toward  prevention  of  future  attacks  to  the  current  analysis  of  past 
attacks. 


Fort  Bragg,  1995 

At  0631  on  27  October  1995,  Army  Sergeant  (SGT)  William  Kreutzer,  Jr.  opened 
fire  on  a  2nd  Brigade,  82nd  Airborne  Division  formation  preparing  for  a  brigade  run  from 
a  nearby  wood  line.  Armed  with  two  semi-automatic  rifles,  two  pistols,  a  knife,  and 
nearly  900  rounds  of  ammunition,  he  methodically  wounded  eighteen  Soldiers  and  killed 
one.  The  death  toll  could  have  been  much  worse  if  not  for  the  heroic  actions  of  several 
unarmed  Soldiers,  who  upon  hearing  the  shots,  rushed  the  attacker  and  subdued  him  until 
law  enforcement  arrived  on  the  scene. 1 

SGT  Kreutzer’ s  attack  on  fellow  members  of  his  unit  was  not  a  spontaneous  act. 
The  Army’s  failure  to  recognize  Kreutzer  as  a  potential  insider  threat  could  be  identified 
as  early  as  three  years  prior  to  the  attack  during  his  service  with  the  Long  Range 
Surveillance  Company  in  the  XVIII  Airborne  Corps  from  August  1992  to  March  1993. 
During  this  time,  he  told  one  Soldier,  “One  of  these  days  I  am  going  to  kill  somebody.”2 


1  United  States  v.  Sergeant  William  J.  Kreutzer,  Jr.,  Army  9601044  United  States 
Army  Court  of  Criminal  Appeals  (11  March  2004),  23-24. 

2  Ibid.,  20. 
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Kreutzer  also  expressed  a  desire  to  form  a  sniper  team  to  kill  the  President.  In  addition  to 


these  violent  remarks,  Kreutzer’s  performance  as  a  Soldier  was  mediocre  at  best,  which 
led  to  a  reassignment  to  A  Company,  4th  Battalion,  325th  Airborne  Infantry  Regiment, 
82nd  Airborne  Division.3 

During  a  six  month  deployment  to  the  Sinai  Peninsula  in  Egypt,  Kreutzer’s 
mental  health  deteriorated  considerably.  His  relative  inexperience  as  a  Soldier  and  his 
perceived  strange  personality  led  to  problems  between  him  and  members  of  his  unit. 
Kreutzer  became  the  butt  of  several  practical  jokes  and  teasing,  which  angered  him  to  the 
point  of  fantasizing  out  loud  about  killing  some  of  his  squad  members.  In  June  1994, 
Kreutzer  told  another  Soldier  in  his  platoon  that  he  intended  to  get  an  automatic  weapon 
and  “hose  down  the  enlisted  barracks.”4  As  a  result  of  these  outbursts,  his  fellow  Soldiers 
thought  he  was  crazy  and  referred  to  him  as  “Crazy  Kreutzer,”  “Hannibal  Lector,”  and 
“Psycho.”5  Following  another  incident,  Kreutzer’s  platoon  sergeant  talked  to  him  about 
his  statements  and  behavior,  in  which  Kreutzer  stated  he  “Was  so  frustrated  with  the 
situation  he  had  been  thinking  about  shooting  the  members  of  his  team.”6 

Following  the  discussion  with  his  platoon  sergeant,  Kreutzer’s  chain  of  command 
removed  him  from  his  position,  denied  him  access  to  weapons,  and  command  referred 
him  to  seek  mental  health.  After  two  meetings  with  the  division  mental  health  officer,  it 


3  United  States  v.  Kreutzer,  20. 

4  Ibid.,  21. 

5  Ibid. 

6  Ibid. 
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was  determined  that  Kreutzer  had  “problems  with  anger  and  interpersonal  relationships, 
poor  coping  skills,  and  low  self-esteem,  but  that  he  was  not  a  danger  to  others.”7 
Following  the  deployment  to  the  Sinai,  Kreutzer  met  with  the  behavioral  health  officer 
once  more  and  declined  further  counseling,  which  closed  the  case.  Although  the  mental 
health  case  was  closed,  perceptions  of  his  fellow  Soldiers  remained  skeptical.  One 
lieutenant  even  joked  that  “Perhaps  one  day  in  the  future  we  would  see  him  in  a 
McDonalds  blowing  people  away.”8 

Despite  the  ample  documented  cases  of  violent  tendencies,  Kreutzer’s  chain  of 
command  elevated  him  to  acting  squad  leader  following  successful  attendance  to  the 
Primary  Leadership  Development  Course  in  October  1994.  By  March  1995,  Kreutzer  was 
promoted  to  SGT  and  assigned  as  the  weapons  squad  leader.  Even  in  his  new  leadership 
position,  fellow  Soldiers  did  not  respect  him.  Other  noncommissioned  officers  (NCOs) 
told  members  of  his  squad  not  to  listen  to  or  obey  Kreutzer’s  orders.  Kreutzer’s  threats 
and  obsession  with  weapons,  war,  and  death  earned  him  the  new  nicknames  of  “crazy,” 
“Wild  Bill,”  and  “wacko.”9  This  humiliation  led  to  Kreutzer  further  distancing  himself 
from  other  Soldiers  in  his  unit. 

By  October  1995,  Kreutzer  began  to  feel  increasingly  stressed.  His  worries  over 
his  sister’s  injuries  from  a  water  skiing  accident,  new  additional  duties  assigned  to  him, 
and  a  letter  of  reprimand  over  temporarily  losing  an  M-60  machine  gun  barrel  only  added 


7  United  States  v.  Kreutzer ,  21. 

8  Ibid. 

9  Ibid.,  22. 
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to  Kreutzer’s  threats  to  kill  his  superiors  and  fellow  Soldiers.  This  stress  culminated  on 
26  October  1995  when  SGT  Kreutzer  failed  a  key  control  inspection  and  his  squad  failed 
a  packing  list  inspection.  He  decided  to  purchase  his  Soldiers’  missing  gear  with  his  own 
money,  and  when  doing  so  he  concluded  the  Army  as  a  whole  did  not  care  about 
Soldiers.  It  was  at  this  point  Kreutzer  decided  to  “shoot  up  the  run  the  next  morning”  to 
make  others  “take  notice. . .  that  they  weren’t  taking  care  of  Soldiers.”10 

That  evening,  Kreutzer  gathered  the  weapons  and  ammunition  for  the  next 
morning’s  attack  and  spent  the  night  at  a  motel  instead  of  the  barracks.  At  2010,  he  called 
a  member  of  his  squad  and  told  him  not  to  go  to  the  brigade  run  the  next  morning.  When 
asked  to  explain  why,  Kreutzer  told  him  he  was  going  to  “mow  everyone  down.” 1 1  The 
Soldier  thought  Kreutzer  was  joking  and  did  not  take  him  seriously  because  he  had 
previously  talked  about  killing  people.  It  was  not  until  the  following  morning  when 
Kreutzer  did  not  show  up  for  formation  that  the  Soldier  realized  something  was  wrong. 

The  United  Stated  Army  Court  of  Criminal  Appeals,  US  v.  Sergeant  William  J. 
Kreutzer,  Jr.  thoroughly  lays  out  the  background  events  leading  up  to  the  1995  Fort 
Bragg  shooting  incident.  It  goes  into  relative  depth  of  Kreutzer’s  family  background  and 
the  indicators  of  his  violent  tendencies  in  the  years  prior  to  the  attack.  However,  this  is 
not  the  main  focus  of  the  hearing.  The  majority  of  the  appeal  is  based  on  identifying  the 
shortcomings  of  the  defense  during  the  trial  after  the  attack,  and  to  determine  if  the  death 


10  United  States  v.  Kreutzer ,  23. 

11  Ibid. 
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sentence  Kreutzer  originally  received  was  the  appropriate  sentence  for  the  crimes  he 
committed. 

The  appeal  hearing  breaks  down  the  following  topics  into  the  facts  involved,  the 
law,  and  a  follow-up  discussion:  denial  of  defense  requested  expert  consultant  in  capital 
mitigation,  ineffective  assistance  of  counsel,  and  a  final  decision  of  the  court.  While  this 
reference  discusses  the  actions  Kreutzer’ s  chain  of  command  took  following  each  violent 
indicator  he  presented,  it  does  not  explain  the  command’s  reasoning  for  those  actions. 
This  reference  also  does  not  explain  the  options  that  were  available  to  the  command  as  a 
response  to  Kreutzer’ s  threats. 


Fort  Hood,  2009 

One  of  the  most  well-known  and  publicized  insider  threat  attacks  in  recent  US 
history  occurred  on  November  5,  2009  at  Fort  Hood,  Texas.  Army  MAJ  Nidal  Malik 
Hasan  walked  into  the  Fort  Hood  deployment  center  armed  with  two  handguns  and  began 
to  open  fire.  Within  a  matter  of  minutes,  thirteen  DOD  employees  were  dead  and  another 
32  were  wounded  in  the  worst  terrorist  attack  on  US  soil  since  September  11,  2001. 

In  response  to  this  incident,  the  US  Senate  Committee  on  Homeland  Security  and 
Governmental  Affairs  launched  an  investigation  of  the  events  leading  up  to  the  attack 
with  two  goals.  First,  they  assessed  the  information  available  to  the  US  Government  prior 
to  the  attack  and  the  actions  it  took  or  failed  to  take  in  response  to  that  information. 
Second,  they  sought  to  identify  steps  necessary  to  protect  the  US  against  future  acts  of 
terrorism  by  homegrown  violent  Islamic  extremists.  The  information  and  analysis  gained 
through  this  investigation  was  published  in  a  final  report  on  February  3,  201 1  titled  “A 
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Ticking  Time  Bomb:  Counterterrorism  Lessons  Learned  from  the  US  Government’s 


Failure  to  Prevent  the  Fort  Hood  Attack.” 

In  order  to  fully  understand  the  indicators  of  violent  tendencies  Nidal  Hasan 
displayed,  one  must  understand  the  self-radicalization  process  he  went  through  and  the 
beliefs  of  Islamic  extremists.  The  core  principles  of  violent  Islamist  extremism  are  the 
establishment  of  a  global  state  -  or  caliphate  -  where  the  most  radical  interpretation  of 
Shari  ’ah  (Islamic  religious  law)  is  enforced  by  the  government.  The  global  Islamist 
community  is  prioritized  ahead  of  one’s  community  and  country.  In  order  to  accomplish 
this,  the  use  of  violence  against  the  West  generally,  military  personnel,  and  civilians  is 
justified.  Additionally,  Muslims  who  reject  these  extremist  principles  are  also  considered 
by  violent  Islamic  extremists  to  be  the  enemy.12 

The  process  by  which  an  individual  transitions  to  a  violent  Islamist  extremist  is 
known  as  radicalization.13  The  radicalization  process  generally  consists  of  four  phases.14 
Pre-radicalization  is  the  state  of  an  individual  just  prior  to  the  start  of  their  journey  down 
the  path  of  radicalization.15  An  individual’s  lifestyle,  religion,  education,  social  status, 


12  Joseph  I.  Lieberman  and  Susan  M.  Collins,  A  Ticking  Time  Bomb: 
Counterterrorism  Lessons  from  the  U.S.  Government’s  Failure  to  Prevent  the  Fort  Hood 
Attack  (Washington,  DC:  United  States  Senate  Committee  on  Homeland  Security  and 
Governmental  Affairs,  2011),  17,  accessed  21  November  2016, 
https://www.hsgac.senate.gov/imo/media/doc/Fort_Hood/FortHoodReport.pdf. 

13  Ibid. 

14  Mitchell  D.  Silber  and  Arvin  Bhatt,  “Radicalization  in  the  West:  The 
Homegrown  Threat,”  Police  Department,  City  of  New  York,  accessed  29  December 
2016,  www.sethgodin.typepad.com/seths_blog/files/NYPD_Report-Radicalization_in_ 
the_west.pdf,  19. 

15  Ibid.,  22. 
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neighborhood,  and  environment  in  general  all  influence  their  eventual  openness  to  this 
ideology.  Self-identification  marks  the  point  where  an  individual  experiences  a  crisis  or 
significant  event  that  leads  them  to  question  their  previously  held  beliefs.16  In  turn,  the 
individual  seeks  answers  to  their  grievances  through  a  radical  interpretation  of  Islam. 

During  Indoctrination ,  individuals  adopt  violent  Islamist  extremist  ideology  and 
begin  to  see  the  world  as  a  struggle  against  the  West.17  This  is  the  stage  where  an 
individual  progressively  intensifies  his  beliefs  in  a  radical  interpretation  of  Islam,  and  that 
the  conditions  and  circumstances  exist  to  support  and  further  the  cause.18  Finally,  the 
Violence  stage  is  where  individuals  accept  their  duty  to  participate  in  jihad.19 

Nidal  Hasan  graduated  from  Virginia  Tech  with  an  engineering  degree  in  1992 
and  entered  military  service  in  1995.  In  1997,  he  entered  medical  school  at  the  Uniformed 
Services  University  of  the  Health  Sciences  (USUHS)  and  graduated  in  2003.  Hasan  was  a 
resident  in  the  psychiatric  program  at  Walter  Reed  Army  Medical  Center  from  2003  to 
2007,  and  it  was  here  that  his  first  signs  towards  violent  Islamist  extremism  began  to 
manifest.20  Hasan  openly  questioned  to  classmates  whether  he  could  engage  in  combat 
against  other  Muslims.  During  the  third  year  of  his  residency,  Hasan’s  conflicts  with 


16  Silber  and  Bhatt,  30. 

17  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  18. 

18  Silber  and  Bhatt,  36. 

19  Ibid.,  43. 

20  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  28. 
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service  obligations  ripened  to  the  point  that  one  of  his  supervisors  tried  twice  to  convince 
him  to  leave  the  military.21 

From  2006  to  2008  Hasan’s  radicalization  to  violent  Islamist  extremism  came  into 
plain  view.  This  was  the  last  year  of  his  Walter  Reed  residency  and  the  first  year  of  his 
USUHS  fellowship.  One  of  the  academic  requirements  for  graduation  from  his  residency 
was  to  make  a  presentation  on  psychiatric  issues.  Hasan  chose  to  fulfill  this  requirement 
by  giving  an  off-topic  lecture  on  violent  Islamist  extremism.  His  draft  presentation 
consisted  almost  entirely  of  references  to  the  Koran,  without  a  single  mention  of  a 
medical  or  psychiatric  term.22  Hasan’s  draft  presentation  also  presented  extremist 
interpretations  of  the  Koran  as  supporting  grave  physical  harm  and  killing  of  non- 
Muslims.23  He  even  suggested  that  revenge  might  be  a  defense  for  the  terrorist  attacks  of 
September  11,  2001. 24  Hasan’s  superiors  warned  him  that  he  needed  to  revise  the 
presentation  if  he  wanted  to  graduate25  but  did  not  take  any  further  action. 

Upon  reviewing  the  draft  presentation,  the  Psychiatric  Residency  Program 
Director  questioned  whether  Hasan  was  fit  to  graduate.26  He  thought  Hasan  was  “very 


21  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  28. 

22  Ibid. 

23  Ibid. 

24  Ibid. 

25  Ibid. 

26  Ibid. 
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lazy”  and  “a  religious  fanatic.”27  However,  Hasan  improved  the  presentation  and  received 
credit  even  through  a  review  of  the  final  version  showed  that  it  was  still  essentially  a 
collection  of  Koranic  verses  with  minimal  scholarly  content.28  Hasan  graduated  despite 
the  Program  Director’s  reservations.29  Probably  the  most  chilling  feature  of  both  drafts  of 
Hasan’s  presentation  was  that  he  stated  one  of  the  risks  of  having  Muslim- Americans  in 
the  military  was  the  possibility  of  fratricidal  murder  of  fellow  service  members.30 

Following  his  residency,  Hasan  advanced  to  a  two  year  fellowship  at  USUHS. 
Under  normal  circumstances,  Hasan  never  would  have  been  accepted  to  the  fellowship, 
as  it  was  typically  reserved  for  elite  medical  professionals.31  Officers  involved  in  the 
fellowship  selection  process  recounted  that  Hasan  was  accepted  into  the  program  because 
he  was  the  only  Army  applicant  and  the  Army  did  not  want  to  risk  losing  that  fellowship 
if  it  was  not  filled.32  Hasan  told  a  colleague  that  he  applied  only  to  avoid  a  combat 
deployment  to  a  Muslim  country.  Realizing  Hasan’s  motivations,  one  of  his  supervisors 
warned  against  accepting  him.33 


27  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  28. 

28  Ibid.,  29. 

29  Ibid. 

30  Ibid. 

31  Ibid. 

32  Ibid. 

33  Ibid. 
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Almost  immediately  upon  starting  the  fellowship,  Hasan’s  radical  beliefs  became 
unmistakable  and  it  was  clear  he  embraced  violent  Islamist  extremism.  Classmates  felt  he 
had  “fixed  radical  beliefs  about  fundamentalist  Islam”  and  that  he  shared  them  “at  every 
possible  opportunity.”34  Less  than  a  month  into  his  fellowship  in  August  2007,  Hasan 
gave  another  controversial  off-topic  presentation  even  more  incendiary  than  his  previous 
brief  at  Walter  Reed. 

Hasan’s  latest  presentation  entitled,  Is  the  War  on  Terror  a  War  on  Islam:  An 
Islamic  Perspective ,  suggested  that  US  military  operations  are  a  war  against  Islam  rather 
than  based  on  non-religious  security  considerations.35  This  brief  was  so  controversial  the 
instructor  had  to  stop  it  after  just  two  minutes  when  the  class  erupted  in  protest  to 
Hasan’s  views.36  The  presentation  also  gave  defense  to  Osama  bin  Laden,  blamed  the 
United  States  for  problems  in  the  Middle  East,  gave  support  to  suicide  bombing,  and 
argued  that  anger  at  the  United  States  is  justifiable. 

Following  the  presentation,  Hasan  continued  overt  support  of  violent  Islamist 
extremism  to  his  colleagues.  He  told  several  classmates  that  his  religion  took  precedence 
over  the  US  Constitution  he  swore  to  support  and  defend  as  a  US  military  officer.37 
Hasan  repeatedly  made  statements  that  US  policy  could  lead  to  fratricide  in  the  ranks.38 


34  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  29. 

35  Ibid. 

36  Ibid. 

37  Ibid.,  30. 

38  Ibid. 
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These  statements  disturbed  his  classmates  to  the  point  they  reported  Hasan  to  superiors. 
However,  it  is  important  to  note  that  Hasan’s  superiors  took  no  action  and  never  reported 
him  to  Army  counterintelligence  personnel. 

Later  in  the  fellowship,  Hasan  created  yet  another  academic  project  based  on 
violent  Islamist  extremism.  Unlike  the  previous  assignments,  Hasan  framed  this  one  in 
clinical  terms  and  was  perceived  as  less  controversial  than  his  previous  presentations.39 
However,  this  was  the  third  project  in  less  than  a  year  that  Hasan  dedicated  to  violent 
Islamist  extremist  views.  Despite  Hasan’s  overt  displays  of  radicalization  to  violent 
Islamist  extremism,  Hasan’s  superiors  failed  to  discipline  him,  refer  him  to 
counterintelligence  officials,  or  seek  to  discharge  him.40  Although  the  definitive  reasons 
for  these  leadership  failures  are  unknown,  one  of  the  officers  that  reported  to  Hasan’s 
superiors  stated  that  Hasan  was  permitted  to  remain  in  service  because  of  “political 
correctness”  and  ignorance  of  religious  practices.41  That  officer  added  that  he  believed 
that  concern  about  potential  discrimination  complaints  stopped  some  individuals  from 
challenging  Hasan.42 

However,  none  of  Hasan’s  superiors  cited  “political  correctness”  as  the  reason  for 
not  acting  against  Hasan.43  Instead,  they  gave  the  following  reasons  for  not  acting:  (1)  A 
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belief  that  Hasan’s  ideological  views  were  not  problematic  or  were  at  least 
understandable,  (2)  Academic  freedom  and  lack  of  academic  standards,  (3)  A  desire  to 
preserve  the  USUHS  fellowship  by  filling  it  with  an  Army  applicant,  (4)  A  belief  that 
Hasan  provided  understanding  of  violent  Islamist  extremism  as  well  as  the  culture  and 
beliefs  of  Islam,  and  (5)  A  belief  that  Hasan  could  perform  adequately  in  an  installation 
with  other  psychiatrists  to  assist  him. 

Another  area  Hasan’s  superiors  failed  was  proper  evaluation  of  his  performance 
on  paper.  Hasan  was  a  chronic  poor  performer  during  his  residency  and  fellowship.44  His 
directors  at  both  installations  viewed  him  as  a  bottom  25  percent  performer,  and  he  often 
failed  to  meet  basic  job  expectations.  However,  this  poor  performance  was  not  accurately 
reflected  in  Hasan’s  Officer  Evaluation  Reports  (OERs).  His  OERs  from  July  2007  to 
June  2009  both  gave  Hasan  passing  marks  in  the  seven  Army  Values  and  twisted  Hasan’s 
violent  Islamist  extremist  views  in  a  positive  light.  One  report  stated,  “His  unique 
interests  have  captured  the  interest  and  attention  of  peers  and  mentors  alike.”45  The  only 
negative  mark  in  either  OER  was  the  result  of  Hasan  failing  to  take  a  physical  training 
test.46 

Nidal  Hasan  graduated  from  the  USUHS  fellowship  in  the  summer  of  2009  and 
was  subsequently  assigned  to  Fort  Hood,  Texas.  In  October  he  was  selected  for  a 
deployment  to  Afghanistan.  Despite  Hasan’s  history  of  violent  Islamist  extremist  views, 


44  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  33. 

45  Ibid. 
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he  would  deploy  to  provide  psychiatric  care  under  stressful  conditions  in  a  combat  zone 
in  which  the  US  military  is  battling  violent  Islamic  extremists.47  On  November  5,  2009, 
twelve  service  members  and  one  civilian  employee  of  DOD  lost  their  lives  because 
Hasan  was  still  in  the  military.48 

The  findings  of  this  report  concluded  the  Fort  Hood  attack  could  have  been 
prevented,  and  placed  the  blame  on  two  agencies,  the  DOD  and  the  Federal  Bureau  of 
Investigation  (FBI).  For  the  purposes  of  this  study,  the  preponderance  of  focus  went  to 
shortfalls  in  the  DOD’s  ability  to  prevent  this  attack.  However,  one  of  the  findings  did 
reveal  communication  issues  between  DOD  intelligence  and  law  enforcement  and  the 
FBI.  Both  organizations  had  knowledge  that  MAJ  Hasan  was  a  potential  threat,  but  each 
entity  had  information  that  painted  a  part  of  the  full  picture.  Had  that  communication 
taken  place,  proper  authorities  could  have  taken  the  actions  necessary  to  prevent  the 
attack. 

Chapter  3  of  “A  Ticking  Time  Bomb”  provided  the  most  useful  information  into 
the  events  and  indicators  in  the  years  leading  up  to  the  November  5th  attack.  The 
investigation  obtained  the  majority  of  its  information  for  this  chapter  from  Army 
Criminal  Investigation  Division  (CID)  reports  and  testimony  from  first-hand  witnesses. 
In  addition,  the  investigation  gained  access  to  Hasan’s  OERs  and  two  Power  Point  class 
presentations  Hasan  prepared  while  attending  a  fellowship  at  Walter  Reed  Medical 
Center. 


47  Lieberman  and  Collins,  A  Ticking  Time  Bomb ,  34. 
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In  these  reports  and  interviews,  the  investigation  found  multiple  instances  where 
Nidal  Hasan  overtly  displayed  his  radicalization  to  violent  Islamist  extremism,  and 
identified  that  his  superiors  failed  to  discipline  him  for  his  actions,  failed  to  report  him  to 
Army  counterintelligence  (Cl),  and  failed  to  seek  discharge  from  the  Army.  While  this 
information  is  all  pertinent  to  the  scope  of  this  study,  it  fails  to  answer  how  the  Army  can 
best  compel  Soldiers  to  report.  Although  the  investigation  does  not  specifically  mention 
TARP,  it  does  lend  some  insight  into  the  effectiveness,  or  in  this  case  ineffectiveness,  of 
the  program.  Lastly,  this  case  study  does  not  address  TARP’s  goals  and  what  it  should 
provide. 


Education 

The  Army’s  primary  method  of  education  the  force  about  insider  threats  is  Army 
Regulation  381-12,  Threat  Awareness  Reporting  Program  (TARP),  dated  1  June  2016.  It 
provides  policy  and  responsibilities  for  threat  awareness  and  education  and  establishes  a 
requirement  for  Department  of  the  Army  personnel  to  report  any  incident  of  known  or 
suspected  espionage,  international  terrorism,  sabotage,  subversion,  theft  or  diversion  of 
military  technology,  information  systems  intrusions,  and  unauthorized  disclosure  of 
classified  information,  among  others.49  While  TARP  covers  all  matters  of  Cl  interest 
including  those  listed  above,  the  scope  of  this  paper  focuses  on  TARP’s  training 
requirements,  reporting  requirements,  and  behavioral  indicators  of  terrorist  or  extremist 
activities. 


49  US  Department  of  the  Army,  Army  Regulation  (AR)  381-12,  Threat  Awareness 
and  Reporting  Program  (Washington,  DC:  Government  Printing  Office,  2016),  i. 
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Annual  TARP  training  is  required  for  all  Department  of  the  Army  (DA) 
personnel.50  This  training  must  be  conducted  by  a  trained  Cl  agent  to  a  live  audience 
unless  the  conditions  are  such  live  training  is  not  possible.51  In  these  cases,  Soldiers  must 
complete  the  online  training  that  is  available  through  the  Army  Learning  Management 
System  website.52  The  TARP  training  used  is  dictated  by  the  Army  G-2  and  is 
standardized  across  the  Army.  This  training  is  called  the  stand  alone  briefing  tool  (SBT). 
Cl  units  will  use  the  SBT  to  tailor  TARP  training  to  the  audience  and  geographic  area,53 
which  does  provide  limited  flexibility  on  behalf  of  the  Cl  agents  for  what  is  briefed 
during  the  training.  Aside  from  this  annual  briefing  requirement,  TARP  does  not  specify 
any  additional  insider  threat  training  that  is  allowed. 

According  to  TARP,  all  DA  personnel  with  knowledge  of  insider  threat -related 
incidents  must  report  these  incidents  to  the  proper  Cl  authorities.  Personnel  who  fail  to 
report  are  subject  to  punishment  under  the  Uniformed  Code  of  Military  Justice  (UCMJ), 
as  well  as  to  adverse  administrative  or  other  adverse  action  authorized  by  applicable 
provisions  of  the  United  States  Code  (USC)  or  Federal  Regulations.54  Personnel  not 
subject  to  the  UCMJ  who  fail  to  report  are  subject  to  adverse  administrative  action  or 
criminal  prosecution  as  authorized  by  applicable  provisions  of  the  USC  or  Federal 


50  US  Department  of  the  Army,  AR  381-12,  6. 

51  Ibid. 
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Regulations.  In  short,  all  DA  employees  are  required  to  report.  TARP  Chapter  4  outlines 
the  procedures  for  individuals  to  report  Cl  incidents.  They  may  make  reports  directly  to 
their  resident  Cl  office,  and  should  limit  knowledge  of  an  incident  to  those  who  have  an 
absolute  need  to  know.55 

Chapter  3  of  TARP  lists  the  behavioral  indicators  of  terrorist  or  extremist 
activities.  These  indicators  are  listed  in  the  two  tables  below  (Table  3-2,  Indicators  of 
potential  international  terrorist-associated  insider  threats;  and  Table  3-3,  Indicators  of 
extremist  activity  that  may  pose  a  threat  to  Department  of  Defense  or  disrupt  US  military 
operations). 


55  US  Department  of  the  Army,  AR  381-12,  14. 
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Table  3-2 

Indicators  of  potential  international  terrorist-associated  insider  threats 

•  Advocating  support  for  international  terrorist  organizations  or  objectives 

•  Expressing  a  hatred  of  Amencan  society,  culture,  government,  or  pnnciples  of  the  U  S  Constitution  that  implies  support  for  or  connec¬ 
tion  to  an  international  terronst  organization 

•  Advocating  the  use  of  unlawful  violence  or  force  to  achieve  goals  that  are  political,  religious,  or  ideological  in  nature 

•  Sending  large  amounts  of  money  to  persons  or  financial  institutions  in  foreign  countnes 

•  Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United  States  in  support  of  an  international  terrorist  cause 

•  Procuring  supplies  and  equipment,  purchasing  bomb  making  matenals,  or  obtaining  information  about  the  construction  and  use  of  ex¬ 
plosive  devices 

•  Expressing  support  for  persons  or  organizations  that  promote  or  threaten  the  unlawful  use  of  force  or  violence. 

•  Advocating  loyalty  to  a  foreign  interest  over  loyalty  to  the  United  States 

•  Financial  contnbution  or  other  material  support  to  a  foreign  chanty  or  other  foreign  cause  linked  to  support  to  an  international  terronst 
organization 

•  Evidence  of  training  with  or  attendance  at  training  facilities  of  international  terronst  organizations 

•  Any  attempt  to  recruit  personnel  on  behalf  of  a  known  or  suspected  international  terrorist  organization  or  for  terrorist  activities 

•  Familial  ties  or  other  close  associations  to  known  or  suspected  members  of  an  international  terrorist  organization  or  those  supporting 
terrorism 

•  Repeated  viewing,  without  official  sanction,  of  Internet  Web  sites  that  promote  or  support  international  terrorist  themes.’ 

•  Posting  comments  or  exchanging  information,  without  official  sanction,  at  Internet  chat  rooms,  message  boards,  or  blogs  that  promote 
the  use  of  force  directed  against  the  United  States. 

•  Joking  or  bragging  about  working  for  a  foreign  intelligence  service  or  associating  with  international  terronst  activities 
l*g#r»d  for  Table  3-2: 

•  Failure  to  report  these  matters  may  not  form  the  sole  basis  for  disciplinary  action 


Figure  1.  Indicators  of  potential  international  terrorist- associated  insider  threats 

Source:  US  Department  of  the  Army,  Army  Regulation  (AR)  381-12,  Threat  Awareness 
and  Reporting  Program  (Washington,  DC:  Government  Printing  Office,  2016),  11. 


Table  3-3 

Indicators  of  extremist  activity  that  may  pose  a  threat  to  Department  of  Defense  or  disrupt  U.S.  military  operations 

•  Receiving  financial  assistance  from  a  person  who  advocates  the  use  of  violence  to  undermine  or  disrupt  U.S.  military  operations  or  for¬ 
eign  policy. 

•  Soliciting  advice,  encouragement,  finances,  training,  or  other  resources  from  a  person  who  advocates  the  use  of  unlawful  violence  to 
undermine  or  disrupt  U.S.  military  operations  or  foreign  policy. 

•  Making  a  financial  contribution  to  a  foreign  charity,  an  organization,  or  a  cause  that  advocates  the  use  of  unlawful  violence  to  under¬ 
mine  or  disrupt  U.S.  military  operations  or  foreign  policy. 

•  Expressing  a  political,  religious,  or  ideological  obligation  to  engage  in  unlawful  violence  directed  against  U.S.  military  operations  or  for¬ 
eign  policy. 

•  Expressing  support  for  foreign  persons  or  organizations  that  promote  or  threaten  the  use  of  unlawful  force  or  violence  to  achieve  politi¬ 
cal,  ideological,  or  religious  objectives. 

•  Participation  in  political  demonstrations  that  promote  or  threaten  the  use  of  unlawful  violence  directed  against  the  Army,  DOD,  or  the 
United  States  based  on  political,  ideological,  or  religious  tenets,  principles,  or  beliefs. 


Figure  2.  Indicators  of  extremist  activity  that  may  pose  a  threat  to  Department  of 
Defense  or  disrupt  US  military  operations 

Source:  US  Department  of  the  Army,  Army  Regulation  (AR)  381-12,  Threat  Awareness 
and  Reporting  Program  (Washington,  DC:  Government  Printing  Office,  2016),  12. 
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These  tables  from  Chapter  3  of  TARP  include  a  comprehensive  list  of  threat 
indicators  that  are  required  to  be  reported  to  Cl  personnel.  With  the  exception  of  viewing 
unauthorized  websites  that  promote  or  support  international  terrorism,  failure  to  report 
any  of  these  indicators  could  lead  to  adverse  administrative  or  punitive  actions.  Although 
failure  to  report  could  lead  to  negative  actions,  instances  of  this  being  used  could  not  be 
identified  through  available  research. 

In  order  to  ensure  effective  implementation  of  TARP,  AR  381-12  included  an 
Internal  Control  Evaluation  section  in  Appendix  B.  This  evaluation,  which  is  required 
annually  each  time  a  Command  Inspection  Program  occurs,  or  at  a  minimum  once  every 
five  years,  certifies  that  a  unit  is  following  the  procedures  outlined  in  TARP.  There  are 
five  questions  that  pertain  directly  to  unit  commanders  at  all  levels,  which  are  outlined 
below.  Have  Army  commanders  - 

1.  .  Established  procedures  to  ensure  that  TARP  training  is  scheduled  for 
members  of  their  unit? 

2.  .  Included  the  requirements  of  AR  381-12  as  a  mandatory  subject  in  the 
organizational  inspection  program? 

3.  .  Established  a  process  to  track  TARP  training  in  their  units? 

4.  .  Established  a  process  to  track  TARP  training  on  their  installation,  if 
appropriate? 

5.  .  Maintained  contact  information  for  the  supporting  Cl  unit  (identity  of  office, 
names  of  Cl  agents,  phone  numbers,  and  e-mail  addresses)?56 

56  US  Department  of  the  Army,  AR  381-12,  21. 
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AR  381-12  outlines  TARP  as  the  Army’s  primary  method  of  educating  and 
training  the  force  to  recognize  and  report  potential  insider  threats.  While  it  covers  all  Cl 
matters,  it  does  specifically  address  activities  associated  with  Soldiers  with  possible  ties 
to  violent  extremist  or  terrorist  organizations.  Its  comprehensive  list  of  behavioral 
indicators  identify  actions  a  Soldier  may  display  prior  to  conducting  an  act  of  targeted 
violence  against  fellow  service  members.  In  addition,  it  clearly  states  the  reporting 
requirements  of  all  DA  employees,  and  articulates  possible  repercussions  for  failure  to 
report.  While  TARP  lists  some  of  the  actions  that  are  available  to  commanders,  it  is  not 
an  all-encompassing  list  of  every  action  a  commander  may  take.  However,  these 
additional  actions  are  included  in  another  regulation,  AR  600-20,  Army  Command 
Policy. 


Options  Available  to  Commanders 
Limitations  on  Information  Sharing 

One  of  the  challenges  commanders  face  with  identifying  potential  threats  within 
their  formations  is  understanding  what  information  about  their  Soldiers  they  are  allowed 
to  access.  The  two  primary  documents  limiting  the  sharing  of  personal  information  are 
the  Privacy  Act  of  1974  and  the  privacy  regulations  in  the  Health  Insurance  Portability 
and  Accountability  Act  (HIPAA)  of  1996.  In  August  2012  the  DOD  Defense  Science 
Board  released  the  Task  Force  Report:  Predicting  Violent  Behavior.  This  study  was  one 
of  several  reviews  that  resulted  from  the  killings  that  took  place  on  November  5,  2009  at 
the  Fort  Hood,  Texas  Soldier  Readiness  Center.57  In  it,  the  study  found  that  there  is  a  lack 

57  Defense  Science  Board,  Task  Force  Report:  Predicting  Violent  Behavior 
(Washington,  DC:  Office  of  the  Under  Secretary  of  Defense  for  Acquisition,  Technology 
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of  clarity  and  understanding  among  commanders,  supervisors,  and  healthcare  providers 
regarding  Privacy  Act  and  HIPAA  regulations  on  the  releasability  of  information  that 
may  be  relevant  to  documenting  and  reporting  concerning  behavior.58  Part  of  the  reason 
for  this  is  the  complexity  of  both  the  Privacy  Act  and  HIPAA. 

Predicting  Violent  Behavior  identified  that  in  many  cases  involving  acts  of 
targeted  violence,  the  perpetrator  displayed  one  or  more  of  the  following:  contemplated 
harming  himself  or  others;  was  in  need  of  help  due  to  stressful  life  circumstances;  was 
otherwise  isolated  from  his  colleagues,  depressed,  or  engaged  in  questionable 
associations  or  activities.59  Relevant  information  might  have  been  known  to  co-workers, 
family  or  friends,  or  even  supervisors  or  commanders.60  In  some  cases  this  information 
was  known  to  medical  or  law  enforcement  personnel.61  However,  in  many  cases  this 
information  was  ignored,  suppressed,  or  otherwise  failed  to  result  in  any  type  of  action.62 
This  is  partially  due  to  these  different  persons  or  organizations  only  having  small  pieces 
of  the  full  informational  picture.  Had  this  information  been  shared,  compiled,  and 
analyzed  by  professionals  it  may  have  presented  a  compelling  case  for  intervention.63 


and  Logistics,  2012),  1. 

58  Defense  Science  Board,  1. 

59  Ibid.,  7. 

60  Ibid. 

61  Ibid. 

62  Ibid. 

63  Ibid.,  8. 
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Whether  the  limitations  on  information  sharing  are  real  or  perceived,  the  lack  of 
understanding  leads  to  an  abundance  of  caution  and  impedes  information  flow.64  The 
default  behavior  is  to  not  release  any  information  that  could  potentially  fall  under  the 
Privacy  Act  or  HIPAA.65 


Organizational  Relationships 

The  Privacy  Act  of  1974  and  HIPAA  are  not  the  only  factors  that  limit  the  sharing 
of  information.  Predicting  Violent  Behavior  found  that  commanders  and  supervisors  do 
not  have  sufficient  visibility  into  personnel  records  of  Soldiers  transferring  into  their 
command.  Each  new  assignment  effectively  represents  a  “clean  slate”  whereby  behaviors 
of  concern  are  not  documented  across  assignments,  patterns  get  lost,  and  prevention 
becomes  significantly  more  difficult.66  There  is  very  little  continuity  of  Soldier 
counseling  or  disciplinary  actions  that  transfer  to  a  new  command  during  a  permanent 
change  of  station  (PCS)  move. 

The  Task  Force  also  found  that  the  Military  Departments,  with  the  exception  of 
the  Army,  currently  operate  a  centralized,  combined  intelligence,  Cl,  and  law 
enforcement  threat  information  sharing  capability.67  This  separation  of  these  key  entities 
perpetuates  failure  and  significantly  limits  an  organization’s  ability  to  accurately  access 


64  Defense  Science  Board,  8. 

65  Ibid. 

66  Ibid. 

67  Ibid.,  9. 


32 


the  nature  of  any  type  of  threat.68  Predicting  Violent  Behavior  recommends  that  the 
current  relationship  between  the  Army’s  Intelligence  and  Security  Command  (INSCOM), 
the  Criminal  Investigation  Command  (CID),  and  law  enforcement  should  be  revaluated 
with  the  goal  of  operating  in  a  more  integrated  manner  without  inserting  organizational 
boundaries  as  potential  barriers  to  the  rapid  flow  of  relevant  information.69 

Command  Policy 

The  Army’s  doctrine  for  command  policy  is  outlined  in  AR  600-20,  dated  6 
November  2014.  The  purpose  of  this  regulation  is  to  prescribe  the  policies  and 
responsibilities  of  command,  which  include  the  Army  Ready  and  Resilient  Campaign 
(R2C)  Plan,  military  discipline  and  conduct,  the  Army  Equal  Opportunity  (EO)  Program, 
and  the  Army  Sexual  Harassment/Assault  Response  and  Prevention  (SHARP)  Program.70 
This  regulation  is  divided  into  eight  chapters:  (1)  Introduction,  (2)  Command  Policies,  (3) 
Ready  and  Resilient,  (4)  Military  Discipline  and  Conduct,  (5)  Other  Responsibilities  of 
Command,  (6)  Equal  Opportunity  Program,  (7)  Prevention  of  Sexual  Harassment,  and  (8) 
Sexual  Assault  Prevention  and  Response  Program.  This  paper  will  focus  on  chapter  4, 
Military  Discipline  and  Conduct,  but  will  address  other  topics  that  help  answer  the 
research  questions  of  what  options  are  available  to  commanders  and  how  to  compel 
Soldiers  to  report. 


68  Defense  Science  Board,  9. 

69  Ibid. 

70  US  Department  of  the  Army,  Army  Regulation  (AR)  600-20,  Army  Command 
Policy  (Washington,  DC:  Government  Printing  Office,  2014),  1. 
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The  key  elements  of  command  are  authority  and  responsibility.71  It  is  the 
commander’s  overall  responsibility  to  establish  a  climate  within  the  unit  that  allows  for 
the  development  of  discipline  and  cohesion.  In  order  to  build  a  positive  command 
climate,  leaders  must  consider  their  Soldiers’  needs  and  care  for  their  well-being.  Military 
discipline  is  maintained  through  the  commander’s  authority  of  the  use  of  the  UCMJ. 
Commanders  strive  to  use  the  full  range  of  human  potential  in  their  organization  and 
properly  train  their  Soldiers  to  ensure  both  personnel  and  equipment  are  in  the  proper 
state  of  readiness  at  all  times.72 

All  commanding  officers  and  others  in  authority  in  the  Army  are  required:  to 
show  in  themselves  a  good  example  of  virtue,  honor,  patriotism,  and  subordination;  to  be 
vigilant  in  inspecting  the  conduct  of  all  persons  who  are  placed  under  their  command;  to 
guard  against  and  suppress  all  dissolute  and  immoral  practices,  and  to  correct,  according 
to  the  laws  and  regulations  of  the  Army,  all  persons  who  are  guilty  of  them;  to  take  all 
necessary  and  proper  measures,  under  the  laws,  regulations,  and  customs  of  the  Army; 
and  to  promote  and  safeguard  the  moral,  the  physical  well-being,  and  the  general  welfare 
of  the  officers  and  enlisted  persons  under  their  command  or  charge.73  In  short,  they  are 
responsible  for  the  overall  well-being  and  good  order  and  discipline  of  the  unit. 

Chapter  2  of  Army  Command  Policy  outlines  command  policies.  Two  of  these 
policies  that  are  potential  options  available  to  commanders  are  the  use  of  open  door 


71  US  Department  of  the  Army,  AR  600-20,  2. 

72  Ibid. 

73  Ibid. 
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policies  and  performance  counseling.  Commanders  are  required  to  establish  an  open  door 
policy  within  their  commands.74  The  purpose  of  an  open  door  policy  is  to  ensure  that  the 
commander  is  made  aware  of  problems  that  affect  the  discipline,  moral,  and  mission 
effectiveness  of  a  unit.75  It  allows  members  of  the  command  to  present  facts,  concerns, 
and  problems  of  a  personal  or  professional  nature  or  other  issues  that  the  Soldier  has  been 
unable  to  resolve.76  While  commanders  are  responsible  for  establishing  how  the  open 
door  policy  is  implemented,  Soldiers  are  responsible  for  utilizing  it  to  bring  matters  to  the 
commander.  This  is  an  important  concept  that  will  be  discussed  further  in  Chapter  4, 
Analysis,  of  this  paper. 

Another  policy  stated  in  Army  Command  Policy  is  performance  counseling. 
Commanders  need  to  ensure  that  all  members  of  their  command  receive  timely 
performance  counseling.77  Performance  counseling  can  inform  Soldiers  and  document  on 
paper  their  expectations  of  performance.  In  addition,  this  is  an  opportunity  for  leaders  to 
address  any  concerns  in  behavior  that  may  be  deemed  unacceptable  by  the  command  and 
the  Army. 

Army  Command  Policy  Chapter  3  addresses  the  Ready  and  Resilient  Campaign 
(R2C).  R2C  is  a  far-reaching  and  comprehensive  initiative  to  enhance  individual  and 


74  US  Department  of  the  Army,  AR  600-20,  6. 

75  Ibid. 

76  Ibid. 

77  Ibid. 
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collective  resilience  in  order  to  improve  readiness  across  the  Army.78  This  initiative 
integrates  all  of  the  external  resources  the  Army  can  provide  to  improve  physical, 
psychological,  and  emotional  health.79  R2C  guides  the  Army’s  efforts  in  cultivating  a 
holistic,  multidisciplinary  approach  to  health  promotion.80  This  initiative  integrates  and 
synchronizes  multiple  Army- wide  efforts  to  enhance  individual  performance  and  increase 
overall  unit  readiness.81  R2C  identifies  mental  health  as  a  component  of  overall  Soldier 
readiness.  This  will  be  discussed  further  in  Chapter  4  of  this  paper,  specifically  in  regards 
to  the  case  study  involving  William  Kreutzer,  Jr  and  the  mental  health  issues  he  faced. 

The  bulk  of  research  into  Army  Command  Policy  regarding  preventing  insider 
threat  direct  action  attacks  falls  into  Army  Command  Policy  Chapter  4,  Military 
Discipline  and  Conduct.  This  chapter  highlights  the  commander’s  responsibility  to 
maintain  good  order  and  discipline  in  a  unit  and  describes  the  commander’s  roles  and 
responsibilities  in  this  process.  Military  discipline  will  be  developed  by  individual  and 
group  training  to  create  a  mental  attitude  resulting  in  proper  conduct  and  prompt 
obedience  to  lawful  military  authority.82  It  is  manifested  in  individuals  and  units  by 
cohesion,  bonding,  and  a  spirit  of  teamwork;  by  smartness  of  appearance  and  action;  by 
cleanliness  and  maintenance  of  dress,  equipment,  and  quarters;  by  deference  to  seniors 


78  US  Department  of  the  Army,  AR  600-20,  20. 

79  Ibid. 

80  Ibid. 

81  Ibid. 

82  Ibid.,  23. 
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and  mutual  respect  between  senior  and  subordinate  personnel;  by  the  prompt  and  willing 
execution  of  both  the  letter  and  the  spirit  of  the  legal  orders  of  their  lawful  commanders; 
and  by  fairness,  justice,  and  equity  for  all  Soldiers,  regardless  of  race,  religion,  color, 
gender,  and  national  origin.83 

Ensuring  the  proper  conduct  of  Soldiers  is  a  function  of  command.84  As  such, 
commanders  must  take  action  consistent  with  Army  regulations  and  in  any  case  where  a 
Soldier’s  conduct  violates  good  order  and  discipline.85  For  minor  infractions,  Army 
Command  Policy  states  that  commanders  should  consider  administrative  corrective 
measures  before  deciding  to  impose  nonjudicial  punishment.86  Ways  this  can  be 
accomplished  are  through  extra  training,  on-the-spot  correction,  or  written  counseling,  to 
name  a  few.  For  more  serious  offenses,  commanders  may  resort  directly  to  UCMJ 
actions.  If  a  Soldier  commits  a  crime,  commanders  must  submit  a  DA  Form  4833 
(Commander’s  Report  of  Disciplinary  or  Administrative  Action)  to  the  Provost 
Marshall’s  Office  (PMO)  within  45  days  of  notification.87  In  addition,  if  the  Soldier  holds 
a  security  clearance,  the  unit  security  manager  must  submit  the  DA  Form  4833  to  the 


83 

84 
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US  Department  of  the  Army,  AR  600-20,  23. 
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DOD  Consolidated  Adjudication  Facility  via  the  Joint  Personnel  Adjudication  System 
(JPAS).88 

Regarding  potential  insider  threats,  section  4-12  of  Army  Command  Policy  covers 
extremist  organizations  and  activities.  This  section  reiterates  that  it  is  the  commander’s 
responsibility  to  maintain  good  order  and  discipline  in  the  unit,  and  states  that  every 
commander  has  the  inherent  authority  to  take  appropriate  actions  to  accomplish  this 
goal.89  Section  4-12  identifies  prohibited  actions  by  Soldiers  involving  extremist 
organizations,  discusses  the  authority  of  the  commander  to  establish  other  prohibitions, 
and  established  that  violations  of  prohibitions  contained  in  this  section  or  those 
established  by  the  commander  may  result  in  prosecution  under  various  provisions  of  the 
UCMJ.90  Commanders  must  also  use  this  section  in  conjunction  with  DOD  Instruction 
(DODI)  1325.06  (Handling  Dissident  and  Protest  Activities  Among  Members  of  the 
Armed  Forces).91 

Army  Command  Policy  states  that  military  personnel  must  reject  participation  in 
extremist  organizations  and  activities.92  The  following  list  defines  extremist 
organizations  or  activities  as  ones  that  advocate  - 

1.  .  Racial,  gender,  or  ethnic  hatred  or  intolerance. 


88  US  Department  of  the  Army,  AR  600-20,  25. 

89  Ibid.,  26. 

90  Ibid. 

91  Ibid. 

92  Ibid. 
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2.  .  Creating  or  engaging  in  illegal  discrimination  based  on  race,  color,  gender, 
religion,  or  national  origin. 

3.  .  The  use  of  force  or  violence  or  unlawful  means  to  deprive  individuals  of 
their  rights  under  the  United  States  Constitution  or  the  laws  of  the  United 
States,  or  any  State. 

4.  .  Support  for  terrorist  organizations  or  objectives. 

5.  .  The  use  of  unlawful  violence  or  force  to  achieve  goals  that  are  political, 
religious,  or  ideological  in  nature. 

6.  .  Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United  States  in 
support  of  a  terrorist  or  extremist  cause. 

7.  .  Support  for  persons  or  organizations  that  promote  or  threaten  the  unlawful 
use  of  force  or  violence. 

8.  .  Encouraging  military  or  civilian  personnel  to  violate  laws  or  disobey  lawful 
orders  or  regulations  for  the  purpose  of  disrupting  military  activities 
(subversion). 

9.  9.  Participating  in  activities  advocating  or  teaching  the  overthrow  of  the  US 
Government  by  force  or  violence,  or  seeking  to  alter  the  form  of  government 
by  unconstitutional  means  (sedition).93 

Any  Soldier  that  participates  any  of  the  aforementioned  activities  is  subject  to 
punitive  actions  under  the  UCMJ.  It  is  both  the  commander’s  authority  and  prerogative  to 
prohibit  military  personnel  from  engaging  in  any  other  activities  that  the  commander 


93  US  Department  of  the  Army,  AR  600-20,  26. 
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determines  will  adversely  affect  good  order  and  discipline  or  moral  within  the 
command.94  The  following  are  options  that  are  available  to  the  commander  for  dealing 
with  a  Soldier’s  violation  of  the  prohibitions  mentioned  above: 


1.  UCMJ  action  -  Possible  violations  include  the  following: 

a.  Article  92  -  Violation  or  failure  to  obey  a  lawful  general  order  or 
regulation. 

b.  Article  1 16  -  Riot  or  breach  of  peace. 

c.  Article  117  -  Provoking  speeches  or  gestures. 

d.  Article  134  -  General  article,  specifically,  conduct  which  is  prejudicial 
to  good  order  and  discipline  or  service  discrediting. 

2.  Involuntary  separation  for  unsatisfactory  performance  or  misconduct,  or  for 
conduct  deemed  prejudicial  to  good  order  and  discipline  or  moral. 

3.  Reclassification  actions  or  bar  to  reenlistment  actions,  as  appropriate. 

4.  Other  administrative  or  disciplinary  action  deemed  appropriate  by  the 
commander,  based  on  the  specific  facts  and  circumstances  of  the  particular 

95 

case. 

The  nonjudicial  punishment  authority  for  commanders  rests  in  Article  15,  UCMJ 
and  Part  V,  Military  Manual  for  Courts-Martial  (MCM).96  The  use  of  nonjudicial 
punishment  is  proper  in  all  cases  involving  minor  offenses  in  which  non-punitive 

94  US  Department  of  the  Army,  AR  600-20,  26. 

95  Ibid.,  27. 

96  US  Department  of  the  Army,  Army  Regulation  (AR)  27-10,  Military  Justice 
(Washington,  DC:  Government  Printing  Office,  2011),  3. 
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measures  are  considered  inadequate  or  inappropriate.97  Nonjudicial  punishment  is  meant 
to  be  used  by  commanders  as  a  corrective  measure  to  fix  behaviors.  If  a  commander 
determines  that  the  commander’s  authority  under  UCMJ,  Article  15  is  insufficient  to 
impose  a  proper  punishment,  the  case  may  be  referred  to  an  appropriate  superior.98  Table 
3  illustrates  the  types  of  nonjudicial  punishment  under  Article  15  and  the  maximum 
punishments  available  under  each  type. 


Maximum  Punishments  In  Article  15 

Summarized 

Company  Grade 

Field  Grade 

Restriction 

14  days 

14  days 

60  days 

Extra  Duty 

14  days 

14  days 

45  days 

Pay  Forfeiture 

None 

7  days 

'A  month  for  2 
months 

Rank  Reduction 
(E4  &  below) 

None 

1  grade 

1  or  more 
grades 

Rank  Reduction 
(E5&  E6) 

None 

None 

1  grade 

Rank  Reduction 
(E7  &  up) 

None 

None 

None 

Note:  If  both  restriction  and  extra  duty  are  imposed  they  must  be  served  at  the  same 
time  Pay  forfeiture,  restriction  and  extra  duty  may  be  all  or  partially  suspended 

Figure  3.  Maximum  Punishments  in  Article  15 

Source:  Army  Study  Guide,  accessed  24  January  2017,  http://www.armystudyguide.com/ 
content/army_board_study_guide_topics/militaryJustice/about-article-15.shtml. 


97  US  Department  of  the  Army,  AR  27-10,  3. 

98  Ibid.,  4. 
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According  to  Army  Command  Policy,  it  is  the  commander’s  responsibility  to  take 
positive  actions  to  educate  Soldiers  and  put  them  on  notice  of  the  potential  adverse 
effects  participation  in  extremist  organizations  and  activities."  These  positive  actions 
include  educating  Soldiers  regarding  the  Army’s  EO  policy,  and  that  extremist 
organizations’  goals  are  inconsistent  with  Army  goals,  beliefs,  and  values.100  In  addition, 
commanders  must  advise  Soldiers  that  participation  in  extremist  organizations  or 
activities  will  have  negative  effects  on  their  careers.  Some  of  these  negative  effects  are 
reflections  on  their  evaluation  reports,  potential  removal  of  security  clearances, 
reclassification  actions,  bars  from  reenlistment,  or  reports  to  law  enforcement 
authorities.101 

Commanders  are  also  required  to  notify  their  supporting  Cl  organization  in  cases 
where  they  know  or  suspect  that  Soldiers  are  engaging  in  activities  specified  above  or 
when  they  become  aware  of  any  activities  outlined  in  AR  381-12  (TARP).  It  is  important 
for  commanders  to  maintain  contact  information  for  their  supporting  Cl  unit. 102  In  cases 
where  a  Soldier  has  a  security  clearance,  commanders  are  required  to  ensure  their  unit 
security  manager  submits  the  derogatory  information  as  an  incident  report  in  the  JPAS.103 


99  US  Department  of  the  Army,  AR  600-20,  27. 

100  Ibid. 

101  Ibid. 

102  US  Department  of  the  Army,  AR  381-12,  21. 

103  US  Department  of  the  Army,  AR  600-20,  27. 
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Chapter  5  of  Army  Command  Policy  outlines  other  responsibilities  of  command. 
One  of  these  other  responsibilities  are  the  command  aspects  of  medical  care,  under  which 
mental  health  requirements  are  referenced.  When  a  commander  determines  it  is  necessary 
to  refer  a  Soldier  for  a  mental  health  evaluation,  the  commander  will  ensure  compliance 
with  the  provisions  of  DODI  6490.01  (Mental  Health  Evaluations  of  members  of  the 
Armed  Forces),  which  limits  the  use  of  mental  health  evaluations  in  situations  where 
adversarial  actions  are  involved.104  According  to  DODI  6490.01,  the  responsibility  for 
determining  whether  or  not  a  referral  for  mental  health  evaluation  should  be  made  rests 
with  the  service  member’s  designated  commanding  officer  at  the  time  of  the  referral. 105  If 
a  Soldier  through  actions  or  words  commits,  attempts,  or  threatens  the  use  of  violence 
that  is  likely  to  cause  serious  injury  to  himself,  herself,  or  others  the  commander  shall 
refer  that  Soldier  for  an  emergency  mental  health  evaluation  as  soon  as  practically 
possible. 106  If  a  Soldier  is  determined  not  to  meet  retention  standards,  a  medical  board 
report  shall  be  forwarded  to  the  Services’  Physical  Evaluation  Board  for  determination  of 
fitness  for  continued  military  service.107 

When  a  privileged  mental  healthcare  provider  makes  a  recommendation  to  the 
commander,  the  commanding  officer  shall  make  a  written  record  of  the  actions  taken  and 


104  US  Department  of  the  Army,  AR  600-20,  37-38. 

105  US  Department  of  Defense,  Department  of  Defense  Directive  (DODI)  6490.1, 
Mental  Health  Evaluations  of  Members  of  the  Armed  Forces  (Washington,  DC: 
Government  Printing  Office,  2003),  2. 

106  Ibid.,  3. 

107  Ibid.,  6. 
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reasons  therefore. 108  If  the  healthcare  provider  recommends  that  the  Soldier  be  separated 
from  the  Army  due  to  a  personality  disorder  and  a  pattern  of  potentially  dangerous 
behavior  (more  than  one  episode),  that  recommendation  shall  be  co-signed  by  the  mental 
healthcare  provider’s  commanding  officer. 109  The  Soldier’s  commander  then  has  the 
opportunity  to  follow  or  decline  the  healthcare  provider’s  recommendations. 

Other  responsibilities  of  command  discuss  the  accommodation  of  religious 
practices.  This  section  states  that  commanders  are  required  to  accommodate  Soldiers’ 
worship,  dietary,  medical,  and  grooming  practices  in  addition  to  wear  and  appearance  of 
the  uniform  in  accordance  with  their  preferred  religion. 110  However,  these  practices  must 
not  interfere  with  military  operations  or  the  good  order  and  discipline  of  the  unit.  The 
remainder  of  Army  Command  Policy  deals  with  the  Army’s  Equal  Opportunity  Program 
(EO),  Prevention  of  Sexual  Harassment  (POSH),  and  the  Sexual  Assault  Prevention  and 
Response  Program  (SHARP). 

Overall,  Army  Command  Policy  and  its  supporting  instructional  references  offer 
commanders  a  wide  range  of  options  when  dealing  with  a  Soldier  who  is  a  potential 
threat  to  fellow  members  in  the  unit.  Some  possible  administrative  actions  are  on-the-spot 
corrections,  performance  counseling,  evaluations,  administrative  separations, 
reclassification,  or  bars  to  reenlistment.  If  the  Soldier  possesses  a  security  clearance,  the 
commander  may  have  the  clearance  suspended  or  removed.  Another  option  available  to 


108  US  Department  of  Defense,  DODI  6490.1,  7. 

109  Ibid. 

110  US  Department  of  the  Army,  AR  600-20,  45. 
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commanders  is  to  refer  the  Soldier  to  Behavioral  Health  for  a  mental  health  evaluation.  If 
deemed  unfit  for  service,  the  Soldier  may  be  separated  from  the  Army  for  psychiatric 
means. 

If  necessary,  the  commander  has  the  option  of  seeking  punitive  actions  through 
the  use  of  UCMJ.  The  four  articles  of  UCMJ  the  Soldier  could  potentially  face  are: 
Article  92,  failure  to  obey  a  lawful  general  order;  Article  116,  riot  or  breech  of  peace; 
Article  117,  provoking  speeches  or  gestures;  and  Article  134,  general  article,  specifically 
conduct  which  is  prejudicial  to  good  order  and  discipline  or  service  discrediting.  Army 
Command  Policy  recommends  that  commanders  seek  administrative  corrective  measures 
first,  but  if  the  Soldier  directly  violates  any  of  the  articles  of  UCMJ  stated  above  the 
commander  has  the  option  of  going  directly  to  punitive  actions. 

Lastly,  the  commander  may  refer  the  Soldier  to  law  enforcement  where  a  serious 
crime  outside  the  commander’s  purview  is  committed.  In  any  case,  any  of  the  indicators 
of  violent  or  extremist  activity  outlined  above  or  in  AR  381-12  must  be  reported  to  the 
supporting  counterintelligence  unit.  A  failure  to  report  is  a  failure  to  follow  Army 
Command  Policy. 


Chapter  Summary 

This  chapter  examined  the  literature  available  surrounding  the  two  insider  threat 
case  studies  of  William  Kreutzer,  Jr.  and  Nidal  Hasan,  the  Army’s  TARP  requirements, 
potential  friction  points  in  the  flow  of  information,  and  the  responsibilities  of  command 
and  options  available  to  commanders  as  outlined  in  Army  Command  Policy  in  order  to 
answer  the  primary  research  question:  How  does  the  Army  compel  Soldiers  to  report 


insider  threats  to  the  proper  authorities?  In  both  case  studies,  Army  personnel  had  first- 
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hand  knowledge  of  threat  indicators  as  outlined  in  TARP  and  failed  to  report.  In  addition, 
commanders  did  not  use  the  wide  range  of  options  available  to  them  in  the  handling  of 
high-risk  individuals. 

TARP  is  an  all-inclusive  regulation  that  covers  the  full  spectrum  of  insider 
threats.  The  research  in  this  paper  focused  on  the  Army’s  requirements  for  all  Soldiers  to 
report,  the  indicators  of  violent/extremist  behavior,  and  the  responsibilities  of 
commanders  in  the  implementation  of  TARP.  Army  Command  Policy  outlines  the 
responsibilities  of  command  and  some  options  that  are  available  to  commanders  to 
maintain  good  order  and  discipline  in  a  unit.  Commanders  must  also  take  into  account 
privacy  restrictions  imposed  on  them  by  the  Privacy  Act  of  1974  and  HIPAA.  Finally,  the 
research  discussed  limitations  on  information  sharing  between  different  organizations. 
Information  critical  to  identifying  potential  insider  threats  sometimes  gets  lost  between 
Soldier  PCS  moves,  as  well  as  between  the  different  organizations  both  inside  and 
external  to  the  Department  of  the  Army. 

In  Chapter  3:  Methodology,  this  paper  will  explain  how  the  primary  research 
question  will  be  answered  through  examination  of  the  two  case  studies  and  whether  or 
not  commanders  exercised  their  given  command  authority. 
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CHAPTER  3 


RESEARCH  METHODOLOGY 

Chapter  Introduction 

This  chapter  serves  to  describe  the  steps  to  answer  the  primary  research  question: 
How  does  the  Army  compel  Soldiers  to  report  suspicious  activity  involving  insider 
threats?  Does  the  Army’s  mandatory  Threat  Awareness  and  Reporting  Program  (TARP) 
training  effectively  prevent  direct  action  by  insider  threats?  What  are  TARP's  goals,  and 
what  should  it  provide?  What  options  are  available  to  commanders  who  identified 
potential  insider  threats  within  their  organizations?  Two  case  studies  will  be  examined, 
focusing  on  the  Fort  Bragg  shooting  of  October  27,  1995  and  the  Fort  Hood  shooting  of 
November  5,  2009. 

The  study  used  a  qualitative  methodology  with  a  case  study  research  design  in 
order  to  understand  the  complexities  involved  with  countering  insider  threats.  The  large 
amount  of  data  sources  available  lends  itself  to  this  type  of  research.  Qualitative  case 
study  is  an  approach  to  research  that  facilitates  exploration  of  a  phenomenon  within  its 
context  using  a  variety  of  data  sources.111  The  phenomenon  explored  in  this  study  is 
direct  action  attacks  carried  out  by  insider  threats.  In  order  to  answer  the  primary  and 
secondary  research  questions,  research  could  not  be  limited  to  just  understanding  the 
circumstances  of  the  two  attacks.  Army  policies  and  regulations  also  had  to  be  considered 


1 1 1  Pamela  Baxter  and  Susan  Jack.  “Qualitative  Case  Study  Methodology:  Study 
Design  and  Implementation  for  Novice  Researchers.”  The  Qualitative  Report  13,  no.  4 
(December  2008):  544,  accessed  19  April  2017,  http://www.nova.edu/ssss/ 

QR/QR 1 3-4/baxter.pdf . 
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when  analyzing  the  two  case  studies,  as  these  documents  lay  the  foundation  of  countering 
insider  threats.  Case  study  analysis  enables  the  researcher  to  gather  data  from  a  variety  of 
sources  and  to  converge  the  data  to  illuminate  the  case. 112 

Why  These  Case  Studies? 

The  Fort  Bragg  case  study  is  useful  because  the  shooter’s  motivations  in  this 
instance  are  not  based  on  religious  ideology  or  beliefs.  Since  the  terrorist  attacks  on 
September  11,  2001,  the  majority  of  focus  on  insider  threat  direct  action  attacks  have 
been  primarily  on  identifying  threats  who  have  been  radicalized  in  religious  beliefs, 
either  through  self-radicalization  or  through  external  influence.  However,  it  is  important 
to  highlight  the  fact  that  not  all  insider  threats  are  based  on  fundamental  Islamic 
extremism. 

In  this  case  Army  Sergeant  William  Kreutzer  had  no  ties  to  what  would 
traditionally  be  called  terrorist  activities.  Instead,  Kreutzer  lived  a  life  of  feeling  like  an 
outsider,  and  the  stresses  involved  with  this  eventually  led  him  to  a  state  of  mental 
instability.  In  the  years  and  months  leading  up  to  the  attack,  Kreutzer  repeatedly 
threatened  to  kill  his  fellow  service  members  and  superiors,  but  no  one  around  him  took 
him  seriously.  His  commander  at  one  point  referred  him  to  seek  help  from  a  psychiatrist, 
but  the  Army  psychiatrist  dismissed  him  as  not  a  real  threat.  Despite  all  of  the  indicators, 
at  no  point  was  Kreutzer  reported  to  Army  Cl  or  CID. 

The  Fort  Hood  case  study  is  useful  for  this  study  because  of  the  large  amount  of 
information  available  on  it.  The  severity  of  this  case  is  due  in  part  to  the  large  number  of 

1 12  Baxter  and  Jack,  556. 
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casualties  that  resulted  from  Hasan’s  actions.  As  a  result,  follow-on  investigations  and 
reports  eventually  led  to  modifications  in  how  the  Army  looked  at  dealing  with  insider 
threats. 

This  is  a  case  where  fundamental  Islamic  extremist  beliefs  did  play  a  role  in  the 
motivations  for  the  attack.  Nidal  Hasan  openly  stated  he  was  a  conscientious  objector, 
and  that  he  was  not  willing  to  deploy  to  fight  in  Muslim  countries.  He  also  stated  on 
multiple  occasions  that  he  saw  violence  against  Americans  as  justified  due  to  what  he 
perceived  as  a  war  against  Islam.  As  with  the  Fort  Bragg  case  study,  there  were  multiple 
opportunities  for  Hasan’s  fellow  Soldiers  and  commanders  to  act  upon  the  violent 
indicators  he  displayed.  However,  his  commanders  took  no  action  and  failed  to  report 
him  to  Army  Cl  or  law  enforcement  agencies. 

Education 

A  key  element  of  research  for  answering  how  the  Army  can  compel  Soldiers  to 
report  is  understanding  how  Soldiers  are  trained  and  educated  on  reporting  indicators  of 
insider  threat.  The  primary  doctrine  governing  education  on  insider  threats  is  Army 
Regulation  381-12,  Threat  Awareness  and  Reporting  Program  (TARP).  This  thesis  will 
identify  the  training  requirements  outlined  in  TARP  and  try  to  determine  if  this 
mandatory  training  is  sufficient  enable  Soldiers  to  not  only  recognize  the  indicators,  but 
also  to  know  to  where  and  whom  to  report.  This  thesis  will  also  identify  what 
punishments,  if  any,  are  available  should  Soldiers  fail  to  report. 
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Options  Available  to  Commanders 

One  of  the  main  topics  this  thesis  is  designed  to  clarify  is  what  options  are 
available  to  commanders  who  identify  they  have  a  high-risk  Soldier  within  their 
formation.  Commanders  put  into  this  scenario  face  a  dilemma.  What  is  the  threshold  for 
reporting  the  Soldier  to  Army  Counterintelligence?  What  are  the  effects  on  the  unit  if  the 
Soldier’s  access  to  firearms  is  removed?  If  the  Soldier  is  simply  moved  to  another  unit, 
what  are  the  potential  consequences?  What  kind  of  help  from  outside  the  organization, 
such  as  behavioral  health  counseling,  is  available?  What  are  the  legal  restrictions  facing 
the  commander  and  how  might  the  commander  gain  access  to  derogatory  information 
from  previous  assignments? 

This  thesis  will  explore  all  of  these  questions  through  current  Army  doctrine  and 
regulations,  namely  Army  Command  Policy,  Conscientious  Objection,  Suspension  of 
Favorable  Personnel  Actions,  and  Administrative  Separations.  In  addition,  this  thesis  will 
identify  restrictions  placed  on  the  commander  by  the  Privacy  Act  of  1974  and  the  Health 
Insurance  Portability  and  Accountability  Act  of  1996  (HIPAA). 

Analytical  Model 

In  order  to  answer  the  primary  research  question  and  assess  how  the  Army  could 
have  compelled  reporting,  each  case  study  conducts  a  qualitative  analysis  of  seven 
variables: 

1.  TARP  indicators  of  potential  international  terrorist-associated  insider 
threats113; 


113  Department  of  the  Army,  AR  381-12,  11. 
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2.  TARP  indicators  of  extremist  activity  that  may  pose  a  threat  to  the 
Department  of  Defense  or  disrupt  US  military  operations114; 

3.  Participation  in  extremist  organizations  and  activities  as  defined  by  Army 
Command  Policy115; 

4.  Possible  UCMJ  violations  for  participation  in  extremist  organizations  or 
activities116; 

5.  Administrative  actions  available  to  commanders117; 

6.  Punitive  actions  available  to  commanders118;  and 

7.  Other  actions  available  to  commanders119. 

Each  of  the  seven  variables  will  be  broken  down  into  sub- variables,  which  are 
shown  in  Tables  1-7  below.  The  sub-variables  will  be  assigned  a  (+)  if  it  presented  itself 
in  the  case  study  or  a  commander  used  that  option  that  was  available  to  him/her.  A  (-) 
will  be  assigned  if  this  variable  did  not  present  itself  or  if  the  commander  did  not  follow 
through  with  that  particular  action.  This  information  will  be  used  to  determine  two  things: 
(1)  Did  the  Soldier  who  committed  an  act  of  targeted  violence  present  indicators  of 
violent  tendencies  prior  to  the  attack,  and  (2)  Did  the  commander  use  all  available 


114  Department  of  the  Army,  AR  381-12,  12. 

1 15  Department  of  the  Army,  AR  600-20,  26. 

116  Ibid.,  27. 

117  Ibid.,  6. 

118  Ibid.,  27. 

119  Ibid.,  35-37. 
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options  available  to  try  and  prevent  the  attack?  A  subjective  qualitative  assessment  will 
be  made  on  each  of  the  two  case  studies  and  be  presented  at  the  conclusion  of  chapter  4. 


Table  1.  Sub-variables  of  TARP  Indicators  of  Potential  International  Terrorist- 

Associated  Insider  Threats 


1.  TARP  indicators  of  potential  international  terrorist-associated  insider  threats 

Indicator 

Kreutzer 

Hasan 

Advocating  support  for  ITOs  or  objectives 

Expressing  a  hatred  of  American  society,  culture,  government,  or 
principles  of  the  US  Constitution  that  implies  support  for  or 
connection  to  an  ITO 

Advocating  the  use  of  unlawful  violence  or  force  to  achieve  goals  that 
are  political,  religious,  or  ideological  in  nature 

Sending  large  amounts  of  money  to  persons  or  financial  institutions  in 
foreign  countries 

Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United 
States  in  support  of  an  international  terrorist  cause 

Procuring  supplies  and  equipment,  purchasing  bomb  making 
materials,  or  obtaining  information  about  the  construction  and  use  of 
explosive  devices 

Expressing  support  for  persons  or  organizations  that  promote  or 
threaten  the  unlawful  use  of  force  or  violence 

Advocating  loyalty  to  a  foreign  interest  over  loyalty  to  the  United 
States 

Financial  contribution  or  other  material  support  to  a  foreign  charity  or 
other  foreign  cause  linked  to  support  to  an  ITO 

Evidence  of  training  with  or  attendance  at  training  facilities  of  ITOs 

Any  attempt  to  recruit  personnel  on  behalf  of  a  known  or  suspected 
ITO  or  for  terrorist  activities 

Familial  ties  or  other  close  associations  to  known  or  suspected 
members  of  an  ITO  or  those  supporting  terrorism 

Repeated  viewing,  without  official  sanction,  of  Internet  Web  sites  that 
promote  or  support  international  terrorist  themes 

Posting  comments  or  exchanging  information,  without  official  sanction, 
at  Internet  chat  rooms,  message  boards,  or  blogs  that  promote  the 
use  of  force  directed  against  the  United  States 

Joking  or  bragging  about  working  for  a  foreign  intelligence  service  or 
associating  with  international  terrorist  activities 

Source :  Created  by  author. 
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Table  2.  Sub- variables  of  TARP  Indicators  of  Extremist  Activity 


2.  TARP  Indicators  of  extremist  activity  that  may  pose  a  threat  to  the  Department  of  Defense  or  disrupt 

US  military  operations 

Indicator 

Kreutzer 

Hasan 

Receiving  financial  assistance  from  a  person  who  advocates  the  use  of 
violence  to  undermine  or  disrupt  US  military  operations  or  foreign 
policy 

Soliciting  advice,  encouragement,  finances,  training,  or  other 
resources  from  a  person  who  advocates  the  use  of  unlawful  violence 
to  undermine  or  disrupt  US  military  operations  or  foreign  policy 

Making  a  financial  contribution  to  a  foreign  charity,  an  organization,  or 
cause  that  advocates  the  use  of  unlawful  violence  to  undermine  or 
disrupt  US  military  operations  or  foreign  policy 

Expressing  a  political,  religious,  or  ideological  obligation  to  engage  in 
unlawful  violence  directed  against  US  military  operations  or  foreign 
policy 

Expressing  support  for  foreign  persons  or  organizations  that  promote 
or  threaten  the  use  of  unlawful  force  or  violence  to  achieve  political, 
ideological,  or  religious  objectives 

Participation  in  political  demonstrations  that  promote  or  threaten  the 
use  of  unlawful  violence  directed  against  the  Army,  DOD,  or  the 
United  States  based  on  political,  ideological,  or  religious  tenets, 
principles,  or  beliefs 

Source :  Created  by  author. 
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Table  3.  Sub-variables  of  Participation  in  Extremist  Organizations  and 
Activities  as  Defined  by  Army  Command  Policy 


3.  Participation  in  extremist  organizations  and  activities  as  defined  by  Army  Command  Policy 

Participation  or  activity 

Kreutzer 

Hasan 

Racial,  gender,  or  ethnic  hatred  or  intolerance 

Creating  or  engaging  in  illegal  discrimination  based  on  race,  color, 
gender,  religion,  or  national  origin 

The  use  of  force  or  violence  or  unlawful  means  to  deprive  individuals 
of  their  rights  under  the  United  States  Constitution  of  the  laws  of  the 
United  States,  or  any  State 

Support  for  terrorist  organizations  or  objectives 

The  use  of  unlawful  violence  or  force  to  achieve  goals  that  are 
political,  religious,  or  ideological  in  nature 

Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United 
States  in  support  of  a  terrorist  or  extremist  cause 

Support  for  persons  or  organizations  that  promote  or  threaten  the 
unlawful  use  of  force  or  violence 

Encouraging  military  or  civilian  personnel  to  violate  laws  or  disobey 
lawful  orders  or  regulations  for  the  purpose  of  disrupting  military 
activities  (subversion) 

Participating  in  activities  advocating  or  teaching  the  overthrow  of  the 
US  Government  by  force  or  violence,  or  seeking  to  alter  the  form  of 
government  by  unconstitutional  means  (sedition) 

Source :  Created  by  author. 


Table  4.  Sub-variables  of  UCMJ  Violations 


4.  Possible  UCMJ  violations  for  participation  in  extremist  organizations  or  activities 

UCMJ  Violation  Committed 

Kreutzer 

Hasan 

Article  92:  Violation  or  failure  to  obey  a  lawful  general  order  or 
regulation 

Article  1 16:  Riot  or  breach  of  peace 

Article  1 17:  Provoking  speeches  or  gestures 

Article  134:  General  article,  specifically,  conduct  which  is  prejudicial 
to  good  order  and  discipline  or  service  discrediting 

UCMJ  Violation  Prosecuted  through  Nonjudicial  Punishment 

Kreutzer 

Hasan 

Article  92:  Violation  or  failure  to  obey  a  lawful  general  order  or 
regulation 

Article  116:  Riot  or  breach  of  peace 

Article  1 17:  Provoking  speeches  or  gestures 

Article  1 34:  General  article,  specifically,  conduct  which  is  prejudicial 
to  good  order  and  discipline  or  service  discrediting 
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Source:  Created  by  author. 


Table  5.  Sub-variables  of  Administrative  Actions  Available  to  Commanders 


5.  Administrative  actions  available  to  commanders 

Administrative  action 

Kreutzer 

Hasan 

On-the-spot  corrections 

Performance  counseling  (written) 

Performance  counseling  (verbal) 

Evaluation  Reports 

Extra  training 

Flag  or  bar  to  reenlistment 

Reclassification 

Reassignment 

Involuntary  separation  for  unsatisfactory  performance  or  misconduct, 
or  for  conduct  deemed  prejudicial  to  good  order  and  discipline  or 
service  discrediting 

Submit  an  incident  report  in  the  JPAS 

Source:  Created  by  author. 


Table  6.  Sub- variables  of  Punitive  Actions  Available  to  Commanders 


6.  Punitive  actions  available  to  commanders 

Punitive  action  prior  to  attack 

Kreutzer 

Hasan 

Summarized  Article  15 

Company  Grade  Article  15 

Field  Grade  Article  15 

Recommend  Trial  by  Courts-  Martial 

Source:  Created  by  author. 


Table  7.  Sub-variables  of  Other  Actions  Available  to  Commanders 


7.  Other  actions  available  to  commanders 

Other  actions  available 

Kreutzer 

Hasan 

Use  of  an  open  door  policy 

Command  referral  to  Behavioral  Health 

Report  to  Army  Cl 

Report  to  law  enforcement 
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Source:  Created  by  author. 


Threats  to  Validity 

There  are  several  biases  the  author  brings  to  this  research.  His  experiences  as  a 
Battalion  Intelligence  Officer  targeting  violent  extremists  in  Iraq,  and  as  a 
Counterintelligence  company  commander,  creates  biases  and  threats  to  the  “internal 
validity”  in  this  research. 

The  selection  of  the  two  case  studies,  which  will  be  discussed  in  detail  in  chapter 
4,  Data  Presentation  and  Analysis,  also  brings  some  bias.  These  case  studies  were 
selected  based  off  the  amount  of  information  available,  the  author’s  interest  in  the  case 
studies,  and  the  circumstances  around  the  motivations  of  the  attackers.  The  author  did  not 
want  to  pick  case  studies  that  are  solely  based  around  Islamic  extremism  in  order  to 
highlight  the  fact  that  potential  insider  threats  can  come  from  any  demographic  of  service 
members.  Due  to  the  limited  number  of  case  studies  analyzed,  there  is  a  threat  to 
“external  validity”  based  on  generalizing  conclusions  from  a  sample  of  many  potential 
case  studies. 

The  final  threat  to  validity  is  in  the  case  studies  themselves.  In  the  time  between 
the  most  recent  case  study  and  when  this  research  was  conducted,  the  Army  updated  its 
insider  threat  doctrine  from  Subversion  and  Espionage  Directed  Against  the  Army 
(SAEDA)  to  the  Threat  Awareness  and  Reporting  Program  (TARP).  Part  of  this  change 
was  a  direct  result  of  the  Fort  Hood  terrorist  attack,  and  identifying  the  effectiveness  of 
the  new  TARP  is  a  secondary  research  question  that  will  be  difficult  to  answer. 
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Chapter  Summary 


This  chapter  outlines  two  major  case  studies  and  current  Army  doctrine  to  answer 
the  research  question:  How  does  the  Army  compel  Soldiers  to  report  suspicious  activities 
involving  insider  threat?  The  case  studies  are  SGT  William  Kreutzer,  Jr  and  MAJ  Nidal 
Malik  Hasan.  The  Army  doctrine  and  regulations  are  Army  Command  Policy, 

Suspension  of  Favorable  Personnel  Actions,  and  Administrative  Separations,  in  addition 
to  the  Privacy  Act  of  1974  and  HIPAA  of  1996.  These  case  studies  and  regulations  will 
be  analyzed  to  answer  the  research  question  and  determine  if  current  training  is  sufficient 
to  prevent  future  insider  threat  direct  action  attacks. 

In  order  to  answer  the  primary  research  question  and  assess  how  the  Army  could 
have  compelled  reporting,  each  case  study  conducts  will  analyze  the  variables  of: 

1.  TARP  indicators  of  potential  international  terrorist-associated  insider  threats; 

2.  TARP  indicators  of  extremist  activity  that  may  pose  a  threat  to  the 
Department  of  Defense  or  disrupt  US  military  operations; 

3.  Participation  in  extremist  organizations  and  activities  as  defined  by  Army 
Command  Policy; 

4.  Possible  UCMJ  violations  for  participation  in  extremist  organizations  or 
activities; 

5.  Administrative  actions  available  to  commanders; 

6.  Punitive  actions  available  to  commanders;  and 

7.  Other  actions  available  to  commanders. 
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Chapter  4,  Data  Presentation  and  Analysis,  will  examine  these  case  studies  and 
regulations  in  depth,  followed  by  Chapter  5,  Conclusions,  where  final  recommendations 
will  be  presented. 
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CHAPTER  4 


DATA  PRESENTATION  AND  ANALYSIS 

Chapter  Introduction 

The  primary  research  question  for  the  following  case  studies  is:  How  does  the 
Army  compel  Soldiers  to  report  activities  associated  with  insider  threat  direct  action 
attacks  to  the  proper  authorities?  Secondary  research  questions  that  will  be  considered  for 
these  case  studies  are: 

1.  Does  the  Army’s  TARP  training  effectively  prevent  direct  action  attacks  by 
insider  threats? 

2.  What  are  TARP’s  goals,  and  what  should  it  provide? 

3.  What  actions  are  available  to  commanders  who  identify  potential  insider 
threats  within  their  organizations? 

Each  case  study  will  be  qualitatively  analyzed  using  seven  variables  that  consist 
of  indicators  presented  according  to  TARP  and  Army  Command  Policy,  possible  punitive 
violations  as  outlined  by  the  UCMJ,  along  with  administrative,  punitive,  and  other 
actions  that  commanders  either  acted  upon  or  failed  to  act  upon.  Each  variable  consists  of 
multiple  sub-variables  that  are  derived  from:  AR  381-12,  TARP;  AR  600-20,  Army 
Command  Policy,  and  AR  27-10,  Military  Justice. 

Qualitative  Analysis 

Each  of  the  seven  variables  used  for  this  qualitative  analysis  contain  several  sub¬ 
variables.  The  first  two  variables  (TARP  indicators  of  potential  international  terrorist- 
associated  insider  threats  and  TARP  indicators  of  extremist  activity  that  may  pose  a 
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threat  to  the  DOD  or  disrupt  US  military  operations)  contain  the  indicators  of  these  types 
of  threats  as  outlined  in  TARP,  AR  381-12.  Variable  3,  Participation  in  extremist 
organizations  and  activities  as  defined  by  Army  Command  Policy,  is  broken  down  into 
the  activities  that  indicate  possible  participation  in  extremist  organizations.  Variable  4 
shows  which  articles  of  UCMJ  were  violated  in  each  case  study,  as  well  as  whether  or  not 
these  violations  of  UCMJ  were  prosecuted  through  nonjudicial  punishment.  Variable  5 
consists  of  administrative  actions  that  were  available  to  the  commanders  involved  in 
these  case  studies,  and  Variable  6  are  the  punitive  actions  that  commanders  could  have 
used.  Variable  7  shows  a  list  of  other  actions  that  were  available  to  the  commanders. 

Each  variable  assessed  in  the  case  studies  received  a  (+)  or  a  (-)  value  to  show 
whether  or  not  the  variable  was  present  or  used  in  each  case  study.  For  variables  one 
through  three,  a  (+)  indicates  the  perpetrator  of  the  attack  displayed  those  behaviors  prior 
to  the  attack.  A  (-)  indicates  the  attacker  did  not  display  that  behavior.  Variable  four  is 
broken  down  into  two  parts.  For  the  first  part,  a  (+)  indicates  that  the  attacker  violated 
that  particular  violation  under  the  UCMJ.  For  the  second  part,  a  (+)  indicates  the 
commander  prosecuted  that  UCMJ  violation,  while  a  (-)  indicates  the  commander  took  no 
disciplinary  action.  Variables  five  through  seven  are  actions  that  were  available  to  the 
commanders  in  each  case.  A  (+)  indicates  the  commander  used  that  option,  while  a  (-) 
indicates  the  commander  did  not  use  that  option  available. 

Variable  1:  TARP  indicators  of  potential  international 
terrorist-associated  insider  threats 

Variable  1  consists  of  the  fifteen  different  indicators  of  potential  international 
terrorist-associated  insider  threats  as  outlined  in  TARP.  The  key  word  to  highlight  from 


60 


this  variable  is  international ,  which  implies  ties  to  a  foreign  nexus.  A  foreign  nexus, 
whether  it  be  an  organization,  an  individual,  or  an  ideology,  means  these  indicators  fall 
under  the  purview  of  Army  counterintelligence.  In  the  case  of  William  Kreutzer,  he  did 
not  present  any  of  the  indicators  associated  with  ties  to  an  international  terrorist 
organization  (ITO). 

However,  Nidal  Hasan  did  present  seven  out  of  the  fifteen  possible  indicators.  In 
the  years  leading  up  to  the  attack  on  Fort  Hood,  Hasan  presented  the  following  indicators 
that  are  reportable  under  TARP:  advocating  support  for  ITOs  or  objectives;  expressing  a 
hatred  of  American  society,  culture,  government,  or  principles  of  the  US  Constitution  that 
implies  support  for  or  a  connection  to  an  ITO;  advocating  the  use  of  unlawful  violence  or 
force  to  achieve  goals  that  are  political,  religious,  or  ideological  in  nature;  expressing  a 
duty  to  engage  in  violence  against  DOD  or  the  United  States  in  support  of  an 
international  terrorist  cause;  expressing  support  for  persons  or  organizations  that  promote 
or  threaten  the  unlawful  use  of  force  or  violence;  advocating  loyalty  to  a  foreign  interest 
over  loyalty  to  the  United  States;  and  repeated  viewing,  without  official  sanction,  of 
Internet  Web  sites  that  promote  or  support  international  terrorist  themes.  The  following 
table  shows  a  comparison  of  these  variables  in  the  two  case  studies: 
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Table  8.  TARP  Indicators  of  Potential  International 
Terrorist-Associated  Insider  Threats 


1.  TARP  indicators  of  potential  international  terrorist-associated  insider  threats 

Indicator 

Kreutzer 

Hasan 

Advocating  support  for  ITOs  or  objectives 

(-) 

(+) 

Expressing  a  hatred  of  American  society,  culture,  government,  or 
principles  of  the  US  Constitution  that  implies  support  for  or 
connection  to  an  1TO 

(-) 

(+) 

Advocating  the  use  of  unlawful  violence  or  force  to  achieve  goals  that 
are  political,  religious,  or  ideological  in  nature 

(-) 

(+) 

Sending  large  amounts  of  money  to  persons  or  financial  institutions  in 
foreign  countries 

(-) 

(-) 

Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United 
States  in  support  of  an  international  terrorist  cause 

(-) 

(+) 

Procuring  supplies  and  equipment,  purchasing  bomb  making 
materials,  or  obtaining  information  about  the  construction  and  use  of 
explosive  devices 

(-) 

(-) 

Expressing  support  for  persons  or  organizations  that  promote  or 
threaten  the  unlawful  use  of  force  or  violence 

(-) 

(+) 

Advocating  loyalty  to  a  foreign  interest  over  loyalty  to  the  United 
States 

(-) 

(+) 

Financial  contribution  or  other  material  support  to  a  foreign  charity  or 
other  foreign  cause  linked  to  support  to  an  1TO 

(-) 

(-) 

Evidence  of  training  with  or  attendance  at  training  facilities  of  ITOs 

(-) 

(-) 

Any  attempt  to  recruit  personnel  on  behalf  of  a  known  or  suspected 
ITO  or  for  terrorist  activities 

(-) 

(-) 

Familial  ties  or  other  close  associations  to  known  or  suspected 
members  of  an  ITO  or  those  supporting  terrorism 

(-) 

(-) 

Repeated  viewing,  without  official  sanction,  of  Internet  Web  sites  that 
promote  or  support  international  terrorist  themes 

(-) 

(+) 

Posting  comments  or  exchanging  information,  without  official  sanction, 
at  Internet  chat  rooms,  message  boards,  or  blogs  that  promote  the 
use  of  force  directed  against  the  United  States 

(-) 

(-) 

Joking  or  bragging  about  working  for  a  foreign  intelligence  service  or 
associating  with  international  terrorist  activities 

(-) 

(-) 

Source:  Created  by  author. 


Variable  2:  TARP  indicators  of  extremist  activity  that  may  pose  a  threat  to  the 
Department  of  Defense  or  disrupt  US  military  operations 

Variable  2  consists  of  six  indicators  of  extremist  activity  that  may  pose  a  threat  to 

the  United  States  or  US  military  operations.  As  with  Variable  1,  Kreutzer  did  not  display 
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any  of  the  indicators  of  extremist  activity  as  outlined  in  TARP.  Nidal  Hasan,  on  the  other 
hand,  displayed  three  of  the  six  indicators:  soliciting  advice,  encouragement,  finances, 
training,  or  other  resources  from  a  person  who  advocates  the  use  of  unlawful  violence  to 
undermine  or  disrupt  US  military  operations  or  foreign  policy;  expressing  a  political, 
religious,  or  ideological  obligation  to  engage  in  unlawful  violence  directed  against  US 
military  operations  or  foreign  policy;  and  expressing  support  for  foreign  persons  or 
organizations  that  promote  or  threaten  the  use  of  unlawful  force  or  violence  to  achieve 
political,  ideological,  or  religious  objectives. 

For  the  first  variable,  Hasan  communicated  with  a  known  terrorist  abroad  on 
multiple  occasions.  Although  the  Army  was  unaware  of  these  communications,  the  FBI 
monitored  and  tracked  them.  However,  this  information  was  never  coordinated  or  passed 
to  Army  CL  In  addition,  Hasan  tried  to  justify  terrorism  and  stated  support  to  foreign 
terrorist  organizations  in  multiple  class  presentations.  The  following  table  shows  a 
comparison  of  these  variables  in  the  two  case  studies: 
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Table  9.  TARP  Indicators  of  Extremist  Activity  That  May  Pose  a  Threat 
to  the  Department  of  Defense  or  Disrupt  US  Military  Operations 


2.  TARP  Indicators  of  extremist  activity  that  may  pose  a  threat  to  the  Department  of  Defense  or  disrupt 

US  military  operations 

Indicator 

Kreutzer 

Hasan 

Receiving  financial  assistance  from  a  person  who  advocates  the  use  of 
violence  to  undermine  or  disrupt  US  military  operations  or  foreign 
policy 

(-) 

(-) 

Soliciting  advice,  encouragement,  finances,  training,  or  other 
resources  from  a  person  who  advocates  the  use  of  unlawful  violence 
to  undermine  or  disrupt  US  military  operations  or  foreign  policy 

(-) 

(+) 

Making  a  financial  contribution  to  a  foreign  charity,  an  organization,  or 
cause  that  advocates  the  use  of  unlawful  violence  to  undermine  or 
disrupt  US  military  operations  or  foreign  policy 

(-) 

(-) 

Expressing  a  political,  religious,  or  ideological  obligation  to  engage  in 
unlawful  violence  directed  against  US  military  operations  or  foreign 
policy 

(-) 

(+) 

Expressing  support  for  foreign  persons  or  organizations  that  promote 
or  threaten  the  use  of  unlawful  force  or  violence  to  achieve  political, 
ideological,  or  religious  objectives 

(-) 

(+) 

Participation  in  political  demonstrations  that  promote  or  threaten  the 
use  of  unlawful  violence  directed  against  the  Army,  DOD,  or  the 
United  States  based  on  political,  ideological,  or  religious  tenets, 
principles,  or  beliefs 

(-) 

(-) 

Source:  Created  by  author. 


Variable  3:  participation  in  extremist  organizations  and 
activities  as  defined  by  Army  Command  Policy 

Variable  3  consists  of  nine  indicators  associated  with  participation  in  extremist 
organizations  and  activities  as  defined  by  Army  Command  Policy.  Any  commander  with 
a  Soldier  who  displays  any  of  these  indicators  is  required  to  act  on  them  in  order  to 
maintain  the  good  order  and  discipline  of  the  unit.  William  Kreutzer  did  display  one  of 
these  indicators  on  multiple  occasions:  the  use  of  force  or  violence  or  unlawful  means  to 
deprive  individuals  of  their  rights  under  the  US  Constitution  or  the  laws  of  the  United 
States,  or  any  State.  He  did  this  when  he  openly  made  threats  to  kill  fellow  Soldiers. 


64 


Nidal  Hasan  presented  five  of  the  nine  indicators  outlined  in  Army  Command 
Policy:  the  use  of  force  or  violence  or  unlawful  means  to  deprive  individuals  of  their 
rights  under  the  US  Constitution  or  the  laws  of  the  United  States,  or  any  State;  support 
for  terrorist  organizations  or  objectives;  the  use  of  unlawful  violence  or  force  to  achieve 
goals  that  are  political,  religious,  or  ideological  in  nature;  expressing  a  duty  to  engage  in 
violence  against  DOD  or  the  United  States  in  support  of  a  terrorist  or  extremist  cause; 
support  for  persons  or  organizations  that  promote  or  threaten  the  unlawful  use  of  force  or 
violence.  The  following  table  shows  a  comparison  of  these  variables  in  the  two  case 
studies: 


Table  10.  Participation  in  Extremist  Organizations  and  Activities  as 
Defined  by  Army  Command  Policy 


3.  Participation  in  extremist  organizations  and  activities  as  defined  by  Army  Command  Policy 

Participation  or  activity 

Kreutzer 

Hasan 

Racial,  gender,  or  ethnic  hatred  or  intolerance 

(-) 

(-) 

Creating  or  engaging  in  illegal  discrimination  based  on  race,  color, 
gender,  religion,  or  national  origin 

(-) 

(-) 

The  use  of  force  or  violence  or  unlawful  means  to  deprive  individuals 
of  their  rights  under  the  United  States  Constitution  of  the  laws  of  the 
United  States,  or  any  State 

(+) 

(+) 

Support  for  terrorist  organizations  or  objectives 

(-) 

(+) 

The  use  of  unlawful  violence  or  force  to  achieve  goals  that  are 
political,  religious,  or  ideological  in  nature 

(-) 

(+) 

Expressing  a  duty  to  engage  in  violence  against  DOD  or  the  United 
States  in  support  of  a  terrorist  or  extremist  cause 

(-) 

(+) 

Support  for  persons  or  organizations  that  promote  or  threaten  the 
unlawful  use  of  force  or  violence 

(-) 

(+) 

Encouraging  military  or  civilian  personnel  to  violate  laws  or  disobey 
lawful  orders  or  regulations  for  the  purpose  of  disrupting  military 
activities  (subversion) 

(-) 

(-) 

Participating  in  activities  advocating  or  teaching  the  overthrow  of  the 
US  Government  by  force  or  violence,  or  seeking  to  alter  the  form  of 
government  by  unconstitutional  means  (sedition) 

(-) 

(-) 

Source :  Created  by  author. 
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Variable  4:  Possible  UCMJ  violations  for  participation 
in  extremist  organizations  or  activities 


There  are  four  articles  of  UCMJ  that  pertain  to  the  previous  three  variables  used 
in  this  analysis.  They  are:  Article  92,  violation  or  failure  to  obey  a  lawful  general  order  or 
regulation;  Article  1 16,  riot  or  breach  of  peace;  Article  1 17,  provoking  speeches  or 
gestures;  and  Article  134,  general  article,  specifically,  conduct  which  is  prejudicial  to 
good  order  and  discipline  or  service  discrediting.  In  both  case  studies,  the  perpetrators 
violated  more  than  one  of  the  articles  of  UCMJ  previously  mentioned.  Kreutzer  violated 
Articles  117  and  134,  while  Hasan  violated  Articles  92,  117,  and  134.  In  both  case 
studies,  no  commander  at  any  level  pursued  nonjudicial  punishment  for  violation  of  any 
of  these  articles,  as  seen  in  the  table  below: 


Table  11.  Possible  UCMJ  Violations  for  Participation 
in  Extremist  Organizations  or  Activities 


4.  Possible  UCMJ  violations  for  participation  in  extremist  organizations  or  activities 

UCMJ  Violation  Committed 

Kreutzer 

Hasan 

Article  92:  Violation  or  failure  to  obey  a  lawful  general  order  or 
regulation 

(-) 

(+) 

Article  1 16:  Riot  or  breach  of  peace 

(-) 

(-) 

Article  1 17:  Provoking  speeches  or  gestures 

(+) 

(+) 

Article  134:  General  article,  specifically,  conduct  which  is  prejudicial 
to  good  order  and  discipline  or  service  discrediting 

(+) 

(+) 

UCMJ  Violation  Prosecuted  through  Nonjudicial  Punishment 

Kreutzer 

Hasan 

Article  92:  Violation  or  failure  to  obey  a  lawful  general  order  or 
regulation 

(-) 

(-) 

Article  1 16:  Riot  or  breach  of  peace 

(-) 

(-) 

Article  1 17:  Provoking  speeches  or  gestures 

(-) 

(-) 

Article  134:  General  article,  specifically,  conduct  which  is  prejudicial 
to  good  order  and  discipline  or  service  discrediting 

(-) 

(-) 

Source :  Created  by  author. 
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Variable  5:  Administrative  actions 
available  to  commanders 


Variable  5  looks  at  all  of  the  administrative  actions  that  were  available  to  the 
commanders  involved  in  both  case  studies.  These  options  are  primarily  outlined  in  Army 
Command  Policy  and  TARP,  but  some  are  also  derived  from  other  Army  regulations.  For 
this  analysis,  ten  different  options  were  used  to  determine  which  ones  the  commanders 
used  in  each  case  study.  In  the  Kreutzer  case  study,  information  on  all  ten  variables  was 
not  available.  However,  in  the  information  that  was  available,  it  was  found  that  only  two 
administrative  actions  were  used:  performance  counseling  (verbal)  and  reassignment.  The 
effectiveness  of  these  two  administrative  actions  (or  lack  thereof)  is  apparent,  but  will  be 
discussed  further  in  Chapter  5.  In  the  Hasan  case  study,  only  three  of  the  ten 
administrative  actions  were  used:  on-the-spot  corrections,  performance  counseling 
(verbal),  and  extra  training.  The  comparison  of  administrative  actions  used  in  the  two 
case  studies  are  shown  in  the  table  below: 


Table  12.  Administrative  Actions  Available  to  Commanders 


5.  Administrative  actions  available  to  commanders 

Administrative  action 

Kreutzer 

Hasan 

On-the-spot  corrections 

* 

(+) 

Performance  counseling  (written) 

* 

* 

Performance  counseling  (verbal) 

(+) 

(+) 

Evaluation  Reports 

* 

(-) 

Extra  training 

* 

(+) 

Flag  or  bar  to  reenlistment 

(-) 

(-) 

Reclassification 

(-) 

(-) 

Reassignment 

(+) 

(-) 

Involuntary  separation  for  unsatisfactory  performance  or  misconduct, 
or  for  conduct  deemed  prejudicial  to  good  order  and  discipline  or 
service  discrediting 

(-) 

(-) 

Submit  an  incident  report  in  the  JPAS 

(-) 

(-) 

information  not  available  in  the  research. 


Source :  Created  by  author. 


67 


Variable  6:  Punitive  actions 
available  to  commanders 

There  are  four  levels  of  punitive  actions  commanders  can  utilize  for  violations  of 
UCMJ.  The  level  of  punitive  action  would  be  determined  by  the  commander  based  off 
the  severity  of  the  actions  or  violations  of  UCMJ  the  Soldier  committed.  Summarized 
Article  15,  Company  Grade  Article  15,  and  Field  Grade  Article  15’s  are  used  as 
corrective  measures  to  fix  Soldier  deficiencies.  When  a  commander  deems  the  severity  of 
an  offense  warrants  more  severe  punishment,  he/she  may  recommend  a  trial  by  courts- 
martial. 

In  the  case  of  William  Kreutzner,  all  four  of  these  levels  of  punitive  actions  could 
have  been  used.  However,  Kreutzer  did  not  face  any  nonjudicial  punishment  prior  to  his 
attack  on  Fort  Bragg.  Nidal  Hasan’s  commanders  did  not  have  all  four  options  available 
to  them.  Due  to  Hasan’s  rank,  any  nonjudicial  punishment  would  be  a  minimum  of  a 
Field  Grade  Article  15.  As  with  the  Kreutzer  case,  Hasan  did  not  face  any  nonjudicial 
punishment  for  his  actions  prior  to  the  attack  on  Fort  Hood.  The  punitive  actions 
available  to  the  commanders  in  both  case  studies  are  listed  in  the  table  below: 


Table  13.  Punitive  Actions  Available  to  Commanders 


6.  Punitive  actions  available  to  commanders 

Punitive  action  prior  to  attack 

Kreutzer 

Hasan 

Summarized  Article  15 

(-) 

N/A 

Company  Grade  Article  15 

(-) 

N/A 

Field  Grade  Article  15 

(-) 

(-) 

Recommend  Trial  by  Courts-  Martial 

(-) 

(-) 

Source :  Created  by  author. 
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Variable  7:  Other  actions  available  to  commanders 


The  research  in  this  study  found  five  additional  options  that  are  available  to 
commanders  when  they  identify  potential  insider  threats  within  their  formations.  The  first 
is  the  use  of  an  open  door  policy.  Having  an  open  door  policy  is  mandated  by  Army 
Command  Policy.  It  allows  Soldiers  the  opportunity  to  address  issues  within  a  unit  that 
may  impact  the  outcome  of  the  unit’s  mission  or  morale.  On  the  reverse  side  of  that, 
Soldiers  are  required  to  bring  matters  to  the  attention  of  the  command  that  may  have  a 
negative  impact  on  the  unit.  Information  about  the  use  of  the  commander’s  open  door 
policy  was  not  available  for  the  Kreutzer  case  study,  but  in  the  Hasan  case  study  the  open 
door  policy  was  used  by  several  of  Hasan’s  classmates  while  he  attended  his  fellowship. 

The  second  option  in  this  variable  is  to  command  refer  a  Soldier  to  behavioral 
health.  According  to  Army  Command  Policy,  when  a  Soldier  makes  statements  that 
threaten  the  use  of  violence  or  intent  to  inflict  grave  harm  on  their  fellow  Soldiers 
commanders  are  required  to  refer  the  Soldier  to  Behavioral  Health  Services  for  a 
psychiatric  evaluation.  In  the  case  of  William  Kreutzer,  his  commander  did  make  the 
command  referral.  However,  the  psychologist  determined  that  Kreutzer  was  not  a 
legitimate  threat.  Nidal  Hasan’s  commanders  never  referred  him  to  behavioral  health. 

The  last  two  options  under  “other  actions”  available  to  commanders  are  to  report 
the  potential  insider  threat  to  Army  Cl  or  to  law  enforcement.  Commanders,  or  fellow 
Soldiers  for  that  matter,  did  not  report  neither  Kreutzer  nor  Hasan  to  Cl  personnel  or  to 
law  enforcement.  Other  actions  used  by  commanders  in  the  two  case  studies  are 
presented  in  the  table  below: 
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Table  14.  Other  Actions  Available  to  Commanders 


7.  Other  actions  available  to  commanders 

Other  actions  available 

Kreutzer 

Hasan 

Use  of  an  open  door  policy 

* 

(+) 

Command  referral  to  Behavioral  Health 

(+) 

(-) 

Report  to  Army  Cl 

(-) 

(-) 

Report  to  law  enforcement 

(-) 

(-) 

information  not  available  in  the  research. 


Source:  Created  by  author. 


Chapter  Summary 

Overall,  both  Kreutzer  and  Hasan  presented  indicators  of  potential  insider  threats 
that  should  have  been  acted  upon  by  their  commanders  and  fellow  Soldiers.  Both  Soldiers 
in  these  cases  violated  articles  punishable  under  UCMJ.  Commanders  in  both  cases  used 
some  of  the  administrative  actions  available  to  them  to  deal  with  these  threats,  but  in 
neither  case  did  they  use  their  command  authority  to  initiate  punitive  actions  in  the  form 
of  nonjudicial  punishment.  The  table  of  overall  results,  shown  below,  illustrates  that 
while  Hasan’s  tendencies  of  insider  threat  were  more  prevalent  than  Kreutzer,  both 
Soldiers  presented  enough  indicators  for  commanders  to  act  on  them. 


70 


Table  15.  Overall  Case  Study  Comparison  Results 


Overall  Results 

Variables 

Kreutzer 

Hasan 

1.  TARP  Indicators  of  potential  international  terrorist- associated  insider 
threats 

(-) 

(+) 

2.  TARP  Indicators  of  extremist  activity  that  may  pose  a  threat  to  the 
Department  of  Defense  or  disrupt  US  military  operations 

(-) 

(+) 

3.  Participation  in  extremist  organizations  and  activities  as  defined  by  Army 
Command  Polcy 

(+) 

(+) 

4.  Possible  UCMJ  violations  for  participation  in  extremist  organizations  or 
activities 

(+) 

(+) 

5.  Administrative  actions  available  to  commanders  used 

(+) 

(+) 

6.  Punitive  actions  available  to  commanders  used 

(-) 

(-) 

7.  Other  actions  available  to  commanders  used 

(+) 

(+) 

Source :  Created  by  author. 


The  primary  research  question  is  answered  in  two  primary  sources,  TARP  and 
Army  Command  Policy.  Soldiers  are  compelled  to  report  indicators  of  insider  threat 
through  regulatory  guidance  that  is  supposed  to  be  enforced  through  the  use  of  UCMJ. 
However,  the  findings  of  this  analysis  indicate  that  although  indicators  were  observed  in 
both  case  studies,  Soldiers  did  not  report  to  Army  Cl  or  law  enforcement  and 
commanders  did  not  take  any  punitive  actions  available  to  them. 

TARP  alone  provided  the  necessary  information  to  identify  the  threat  indicators 
with  Nidal  Hasan.  However,  due  to  the  fact  that  Kreutzer  did  not  have  any  foreign 
connections  or  ties  to  terrorist  organizations,  his  actions  were  technically  not  reportable 
under  TARP  as  it  stands  today.  His  threats  were  disturbing  and  they  did  lead  to  a 
command  referral  to  behavioral  health,  but  he  was  subsequently  cleared  by  a  mental 
health  professional.  Kretzer  presented  a  clear  insider  threat  in  the  basic  sense  but  did  so  in 
a  manner  that  is  not  reportable  to  Army  CL 
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CHAPTER  5 


CONCLUSIONS  AND  RECOMMENDATIONS 

Chapter  Introduction 

The  primary  research  question  of  this  thesis  was:  How  does  the  Army  compel 
Soldiers  to  report  suspicious  activity  associated  with  insider  threats?  The  initial 
hypothesis  was:  more  training  can  be  successful  to  reduce  attacks.  This  training  should 
focus  on  two  areas.  First,  soldiers  and  commanders  need  training  to  recognize  when 
potential  insider  threats  are  marginalized  within  their  organizations,  and  how  they  can 
bring  these  soldiers  back  into  the  fold.  If  soldiers  are  accepted  for  who  they  are  and 
brought  into  the  cohesiveness  of  a  team,  they  will  be  less  likely  to  feel  the  need  to 
commit  an  act  of  violence  against  their  peers.  Second,  training  can  help  compel  soldiers 
to  report  suspicious  behavior  to  their  command  or  proper  authorities.  In  order  to  answer 
this  question,  two  case  studies  were  examined: 

1.  The  Fort  Bragg  shooting  of  27  October  1995  (Kreutzer). 

2.  The  Fort  Hood  shooting  of  5  November  2009  (Hasan). 

Each  case  study  used  a  qualitative  analysis  of  seven  variables:  TARP  indicators  of 
terrorist-associated  insider  threats,  TARP  indicators  of  extremist  activities,  participation 
in  extremist  activities  as  identified  in  Army  Command  Policy,  violations  of  the  UCMJ, 
administrative  actions  available  to  commanders,  punitive  actions  available  to 
commanders,  and  other  actions  available  to  commanders  (see  table  16). 
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Conclusions 


Prior  to  beginning  this  research  project,  the  initial  hypothesis,  that  more  insider 
threat  training  would  increase  reporting  and  therefore  reduce  attacks,  was  based  on 
observations  that  the  Army  only  requires  insider  threat  training  once  annually.  It  was 
assumed  that  the  current  method  of  training  generally  consists  of  a  unit  receiving  their 
annual  TARP  brief  in  an  auditorium- like  setting,  in  conjunction  with  a  plethora  of  other 
AR  350-1  mandatory  training.  This  environment  is  not  conducive  to  Soldiers  retaining 
the  information,  which  lends  itself  to  TARP  becoming  an  afterthought  in  the  minds  of 
Soldiers.  In  addition,  it  was  assumed  that  commanders,  especially  at  the  company  level, 
do  not  have  a  thorough  understanding  of  the  options  available  to  them  when  they  come 
across  a  Soldier  within  their  formations  that  display  indicators  of  potential  insider  threats. 
While  these  assumptions  remain  true,  through  the  analysis  of  the  two  case  studies,  a  more 
complicated  picture  emerges. 

As  identified  in  the  Fort  Hood  case  study,  MAJ  Nidal  Hasan  presented  several  of 
the  indicators  of  insider  threat  that  are  outlined  in  TARP.  While  current  TARP  does 
provide  a  comprehensive  list  of  the  indicators  of  violent  attacks  by  insider  threats,  it  lacks 
the  identification  of  potential  lone  wolf  attacks  with  no  ties  to  a  foreign  actor  or  ideology. 
The  nature  of  TARP  indicators  all  have  ties  to  a  foreign  nexus,  which  falls  under  the 
purview  of  Army  CL  However,  as  with  the  case  of  William  Kreutzer,  the  indicators  he 
presented  do  not  exactly  line  up  with  those  outlined  in  TARP.  Therefore,  had  the  Soldiers 
in  Kreutzer’ s  unit  reported  his  actions  to  Army  Cl,  any  initial  inquiry  into  his  case  would 
not  have  resulted  into  a  full  investigation  because  of  a  lack  of  a  foreign  nexus.  Even 
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though  Kreutzer  clearly  presented  himself  as  a  threat,  Cl  officials  would  have  been 
powerless  to  act. 

Although  TARP  does  not  specifically  address  insider  threats  such  as  Kreutzer, 
another  Army  regulation  does  address  these  types  of  threats.  Army  Command  Policy 
identifies  Soldiers  such  as  Kreutzer  as  potential  threats  through  participation  in  extremist 
organizations  or  activities.  This  is  specifically  addressed  as  the  use  of  force  or  violence  or 
unlawful  means  to  deprive  individuals  of  their  rights  under  the  United  States  Constitution 
or  the  laws  of  the  United  States,  or  any  State.  If  strictly  interpreted,  this  could  apply  only 
to  those  who  actually  carry  out  the  use  of  force  or  violence,  not  those  who  only  carry  out 
threats.  However,  Army  Command  Policy  addresses  this  by  stating  how  commanders  are 
responsible  for  maintaining  good  order  and  discipline  within  the  unit.  Any  threats  of 
force  or  violence  could  be  seen  as  detrimental  to  maintaining  good  order  and  discipline, 
and  therefore  provide  a  means  for  the  commander  to  act  on  those  threats. 

Another  finding  the  research  provided  was  that  Soldiers  who  fail  to  report 
potential  insider  threats  are  subject  to  punitive  actions  under  the  UCMJ.  Although  this  is 
explicitly  stated  in  Army  doctrine,  there  were  no  UCMJ  actions  reported  for  Soldiers  who 
failed  to  report  in  either  case  study.  This  brings  up  a  potential  dilemma  for  commanders. 
Even  though  punitive  actions  are  available  to  commanders  for  Soldiers  who  fail  to  report, 
should  they  even  use  this  option  to  compel  Soldiers  to  report?  How  will  punishing 
additional  Soldiers  affect  the  moral  of  a  unit  that  already  potentially  fell  victim  to  a  direct 
action  attack?  Is  the  legal  evidence  present  to  follow  through  with  such  actions?  The 
conclusion  is  that  punitive  actions  may  not  be  the  best  approach  to  compelling  Soldiers  to 
report  potential  insider  threats. 
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Other  options  available  include  reinforcement  of  the  commander’s  open  door 
policy.  If  a  commander  sets  the  climate  of  transparency  and  fairness  in  the  organization, 
Soldiers  may  be  more  willing  to  use  the  open  door  policy  to  bring  issues  to  the  command. 
Once  an  insider  threat  issue  is  brought  to  the  command’s  attention,  they  are  required  to 
act  on  this  information  to  maintain  the  good  order  and  discipline  in  the  unit.  They  can 
bring  the  Soldier  in  to  talk  to  them  and  potentially  find  out  why  they  feel  the  way  they  do. 
If  actual  threats  are  made,  the  commander  can  command  refer  the  Soldier  to  behavioral 
health  for  a  mental  health  evaluation.  Another  option  is  to  administratively  separate  the 
Soldier  for  unsatisfactory  performance  or  misconduct. 

If  the  commander  determines  the  Soldier’s  statements  or  threats  are  correctable, 
he/she  may  opt  for  nonjudicial  punishment  of  the  Soldier  to  put  them  on  notice.  However, 
separation  from  the  Army  is  always  an  option  if  the  commander  does  not  feel  as  if  the 
Soldier’s  actions  will  be  resolved  through  punitive  actions.  For  repeated  or  more  serious 
offenses,  the  commander  may  recommend  a  trial  by  courts-martial.  In  any  case,  there  are 
several  options  the  commander  could  use  to  address  threats  made  by  a  potential  insider 
threat.  The  case  studies  found  however  that  very  few  of  the  available  options  are  used. 

The  final  conclusion  of  this  study  found  that  current  training  requirements  for 
both  Soldiers  across  the  Army  and  commanders  are  not  sufficient  to  properly  address  all 
forms  of  direct  action  insider  threats.  TARP  specifically  has  two  shortfalls:  First,  that  due 
to  the  counterintelligence-leaning  viewpoints  on  insider  threats,  it  does  not  address  those 
Soldiers  who  have  no  connections  to  a  foreign  nexus,  but  are  rather  simply 
disenfranchised  with  their  unit  and  the  Army  and  do  not  have  a  sufficient  coping 
mechanism;  and  second,  that  annual  training  conducted  in  a  large  auditorium  setting  is 
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not  necessarily  the  best  way  to  familiarize  and  reinforce  identifying  behavioral  indicators 
of  insider  threats.  In  addition  commanders,  particularly  at  the  company  level,  are  not 
properly  trained  on  all  of  the  options  available  to  them  to  address  issues  with  good  order 
and  discipline  in  their  units.  While  Army  Command  Policy  does  lay  these  options  out, 
there  is  no  formalized  training  on  the  matter  in  Army  pre-command  courses  at  the 
company  level. 


Recommendations 

In  order  for  the  Army  to  better  compel  Soldiers  to  report,  the  author’s 
recommendations  focus  on  addressing  ways  to  improve  the  education  of  Soldiers  and 
commanders  on  insider  threats  through  training.  This  thesis  proposes  two  areas  of 
training  that  could  be  implemented  across  the  Army.  First,  the  annual  TARP  requirement 
is  not  sufficient.  To  address  this,  it  is  recommended  the  Army  add  quarterly  TARP 
training  in  the  form  of  scenario-based  training  as  part  of  the  Ready  and  Resilient 
Campaign  (R2C).  Similarly  to  the  implementation  of  SHARP  training,  scenario-based 
training  conducted  at  the  unit  level  would  supplement  the  annual  requirement  that  a  Cl 
special  agent  provides  during  their  required  unit  briefs.  This  training  would  help  Soldiers 
identify  the  behavioral  indicators  of  not  only  insider  threats  with  a  foreign  nexus,  but  also 
those  indicators  of  Soldiers  such  as  Kreutzer  who  threaten  the  use  of  force  or  violence 
against  fellow  service  members.  In  addition,  this  training  would  discuss  the  importance  of 
bringing  disenfranchised  Soldiers  back  into  the  fold  and  ways  to  accomplish  this. 

Training  focused  on  all-inclusive  unit  cohesion  would  help  Soldiers  who  feel  neglected  or 
abandoned  by  their  unit  a  sense  of  purpose  and  welcomed  inclusiveness.  As  part  of  R2C, 


unit  commanders  could  enlist  the  help  of  behavioral  health  experts  to  aid  in  the  training. 
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The  second  area  of  training  would  be  to  add  a  combined  TARP/Army  Command 
Policy  block  of  instruction  to  the  Company  Commanders  and  First  Sergeant’s  Course 
conducted  at  the  installation  level.  This  training  should  focus  on  how  to  identify  potential 
insider  threats  within  their  organizations,  as  well  as  educate  leaders  on  the  options  that 
are  available  to  them  as  outlined  in  TARP  and  Army  Command  Policy.  These  options 
should  cover  the  wide  array  of  administrative  and  punitive  actions  as  outlined  in  this 
paper,  as  well  as  how  to  seek  advice  from  behavioral  health,  legal,  and  other  resources 
the  Army  can  provide. 


Areas  for  Further  Study 

One  potential  area  for  future  study  on  this  topic  is  to  research  ways  to  improve 
information  sharing  across  different  organizations  within  the  Department  of  the  Army.  As 
it  currently  stands,  Army  INSCOM,  CID,  and  other  law  enforcement  agencies  all  have 
similar  goals  of  preventing  violent  direct  action  attacks  carried  out  by  service  members. 
The  Department  of  the  Navy  has  the  Naval  Criminal  Investigative  Service  (NCIS)  and 
the  Air  Force  has  the  Office  of  Special  Investigations  (OSI).  Yet  the  Army  is  the  only 
major  service  without  a  centralized  intelligence,  counterintelligence,  and  law 
enforcement  agency.  Further  research  into  this  topic  could  potentially  lead  to  Doctrine, 
Organization,  Training,  Materiel,  Leadership,  Personnel,  Facilities,  and  Policy 
(DOTMLPF-P)  changes  in  the  Army  to  streamline  information  flow  and  investigations 
into  potential  insider  threats. 

This  study  also  assumed  that  while  not  all  insider  direct  action  attacks  were  the 
result  of  Islamic  Extremist  views,  these  types  of  views  are  the  driving  force  behind  the 


vast  majority  of  insider  threats,  particularly  after  September  11,  2001.  The  wars  in  Iraq 
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and  Afghanistan  are  sources  of  internal  strife  for  some  Muslim  service  members,  which 
when  combined  with  perceived  prejudices  or  unfair  treatment  can  lead  to  self- 
radicalization  and  eventually  an  attack.  Further  study  into  this  trend  could  yield  some 
useful  insights  into  how  to  counter  the  radicalization  of  Muslim  Soldiers,  which  was  not 
specifically  addressed  in  this  study. 


Summary 

Current  Army  doctrine  and  regulations  provide  the  means  to  properly  identify  and 
counter  direct  action  attacks  carried  out  by  insider  threats.  However,  the  training  given  to 
Soldiers  and  commanders  to  educate  them  on  these  regulations  is  not  sufficient  to  compel 
them  to  report  in  all  cases.  The  Fort  Bragg  shooting  of  1995  and  the  Fort  Hood  shooting 
of  2009  both  highlight  these  training  deficiencies.  Allowing  commanders  at  the  unit  level 
to  incorporate  TARP  training  into  their  own  training  plans  in  the  form  of  small  group 
scenario-based  training  will  help  reinforce  not  only  the  importance  of  TARP,  but  will 
help  them  build  unit  cohesion  and  bring  disenfranchised  Soldiers  back  into  the  fold.  In 
addition,  training  commanders  on  the  full  range  of  options  available  to  them  during  pre¬ 
command  courses  will  enable  them  to  make  informed  decisions  when  they  have  to  deal 
with  a  potential  insider  threat  within  their  organization. 
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GLOSSARY 


Extremist  Activity.  An  activity  that  involves  the  use  of  unlawful  violence  or  the  threat  of 
unlawful  violence  directed  against  the  Army,  DOD,  or  the  United  States  based  on 
political,  ideological,  or  religious  tenets,  principles,  or  beliefs. 

Insider  Threat.  US  service  members  or  DOD  employees  who  plan  or  carry  out  direct 
action  attacks  on  fellow  Soldiers  and  DOD  employees  with  the  intent  to  inflict 
loss  of  life  through  violent  means. 

Targeted  Violence.  Pre-meditated  attacks  against  specific  individuals,  populations,  or 
facilities  with  perpetrators  engaged  in  behaviors  that  precede  and  are  related  to 
their  attacks. 

Terrorism.  The  calculated  use  of  violence  or  threat  of  violence  to  inculcate  fear,  intended 
to  coerce  or  to  intimidate  governments  or  societies  in  the  pursuit  of  goals  that  are 
generally  political,  religious,  or  ideological. 

Threat.  According  to  AR  381-12,  the  activities  of  foreign  intelligence  services,  foreign 
adversaries,  international  terrorist  organizations,  or  extremists  that  may  pose  a 
danger  to  the  Army,  DOD,  or  the  United  States;  any  person  with  access  to 
Soldiers,  DOD  installations,  and  facilities  who  may  be  positioned  to  compromise 
the  ability  of  a  unit  to  accomplish  its  mission  where  there  is  evidence  to  indicate 
that  he  may  be  acting  on  behalf  of  or  in  support  of  foreign  Intelligence,  foreign 
adversaries,  international  terrorists,  or  extremist  causes. 
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